CVE-2026-39889

creationtimestamp| type| source ---|---|--- 2026-04-09 01:27:25+00:00| published-proof-of-concept| Telegram/uNEbWTFRO9kglbQXnY7zSMHaUxTxgzOMmWKv2o-GlQMO0RY 2026-04-09 06:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj24xuv4nu25...

CVE-2026-39370

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...

CLEANSTART-2026-MI26424 net/url package does not set a limit on the number of query parameters in a query

Multiple security vulnerabilities affect the cert-manager package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...

CVE-2026-1516

creationtimestamp| type| source ---|---|--- 2026-04-09 00:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizks6xl5325 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen|...

CVE-2026-2619

creationtimestamp| type| source ---|---|--- 2026-04-09 00:27:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizkdqayet2q 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen|...

CVE-2026-4916

creationtimestamp| type| source ---|---|--- 2026-04-09 00:17:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizjtilwou2g 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen|...

CVE-2026-4398

creationtimestamp| type| source ---|---|--- 2026-04-09 00:03:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizizvmm3i2t 2026-08-26 12:30:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydkmt2jf26...

CVE-2025-70797

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

PT-2026-31566

Name of the Vulnerable Software and Affected Versions atototo api-lab-mcp versions up to 0.2.1 Description A weakness exists in the HTTP Interface component of atototo api-lab-mcp. Manipulation of the source/url argument within the analyze api spec/generate test scenarios/test http endpoint...

PT-2026-31667

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

Fedora 42 : roundcubemail (2026-051825ca18)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-051825ca18 advisory. Version 1.6.15 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to some regressions introduced in the...

Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details abou...

CVE-2025-70797

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

PT-2026-31587

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.3.0 Description A code injection issue exists in the Data Source Handler component of jeecgboot JimuReport, specifically within the DriverManager.getConnection function located in the...

RockyLinux 10 : grafana (RLSA-2026:6344)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6344 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the RockyLinux...

RHEL 9 : rhc (RHSA-2026:7315)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7315 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

CVE-2025-70797

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Boxtitle and boxurl parameters...

JimuReport 代码注入漏洞

JimuReport is a free reporting tool developed by JEECG in China. Versions of JimuReport 2.3.0 and earlier had a code injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter dbUrl in the DriverManager.getConnection function within the Data Source Handler...

ALSA-2026:7259 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details abou...

RHEL 10 : rhc (RHSA-2026:7328)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:7328 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...