CVE-2026-40261

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...

CVE-2026-33438

creationtimestamp| type| source ---|---|--- 2026-04-15 20:45:47+00:00| seen| https://bsky.app/profile/bearstech.com/post/3mjkragvitl2o...

JLSEC-2026-119 Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user...

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host...

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Summary NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Vulnerable Code 1. Workflow HTTP...

CVE-2025-60991

creationtimestamp| type| source ---|---|--- 2026-04-15 19:20:49+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mjkmiin6ad26...

CVE-2026-20152

creationtimestamp| type| source ---|---|--- 2026-04-15 19:17:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkmbzpqxh2o 2026-04-16 17:19:57+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116415528739254723 2026-04-16 18:00:00+00:00| seen|...

CVE-2026-40173

creationtimestamp| type| source ---|---|--- 2026-04-15 19:04:22+00:00| published-proof-of-concept| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p 2026-04-15 22:37:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkxiotu4e2g 2026-04-15 23:27:13+00:00|...

CVE-2026-20136

creationtimestamp| type| source ---|---|--- 2026-04-15 18:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkjwvn37e2t 2026-07-03 10:46:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqelg5ydk2w...

CVE-2026-20081

creationtimestamp| type| source ---|---|--- 2026-04-15 18:33:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkjt2moz52a 2026-04-16 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities20260417...

CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...

CVE-2026-39845

Weblate (web-based localization tool) has a vulnerability in versions prior to 5.17 where the webhook add-on did not apply SSRF protections. The root cause is exposure via the webhook add-on’s fetch_url() path, enabling potential SSRF risks as described in the CVE entry. The issue is fixed in ver...

CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...

CVE-2026-6310

creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:12:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjksqevtfj2z 2026-04-15 23:26:54+00:00|...

CVE-2026-6307

creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 22:00:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkvg6qnoi2w 2026-04-15 23:26:54+00:00|...

CVE-2026-6302

creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:54:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkv3gnbe32z 2026-04-15 23:26:33+00:00|...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via “Contact Point Writer” role that by default grants permission to alert.notifications:write or alert.notifications.receivers:test actions. An attacker can gain unauthorized access to sensitive configuration data,...

CVE-2026-1636

creationtimestamp| type| source ---|---|--- 2026-04-15 15:51:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkastkvv52o...

CVE-2026-1852

creationtimestamp| type| source ---|---|--- 2026-04-15 15:46:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkajv3ytc2r...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...