CVE-2026-3184

creationtimestamp| type| source ---|---|--- 2026-04-03 20:10:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimjp22yf623 2026-04-07 08:01:11+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mivcqr6hze42 2026-04-14 13:10:07+00:00| seen|...

CVE-2026-35216

creationtimestamp| type| source ---|---|--- 2026-04-03 17:26:47+00:00| published-proof-of-concept| Telegram/CfZ2Rt5oDMh5hfP6-7c66YyHAz2lNtcnTrevEl4rY2ivCc 2026-04-03 18:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimewx5ekf2g 2026-04-04 06:17:22+00:00| seen|...

CVE-2026-5346

A vulnerability was determined in huimeicloud hmeditor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-5470

creationtimestamp| type| source ---|---|--- 2026-04-03 16:35:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mim5nfywxa2i...

CVE-2026-25043

creationtimestamp| type| source ---|---|--- 2026-04-03 16:30:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mim5fqfxge2i...

CVE-2026-25118

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within t...

GHSA-P8C7-HJC4-GWF8 Casdoor vulnerable to SSRF via crafted Webhook URL

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

Casdoor vulnerable to SSRF via crafted Webhook URL

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

EUVD-2026-18658

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-27655

creationtimestamp| type| source ---|---|--- 2026-04-03 15:23:03+00:00| seen| Telegram/DMrtbPbyVuvJyzUNlrr2TA99ljgvsTw1ZTHgoXyjyFD12Ec 2026-04-03 15:36:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mim2dsq4oj26 2026-04-04 02:20:09+00:00| seen|...

CVE-2026-5469

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-5469

CVE-2026-5469 affects Casdoor version 2.356.0, specifically the Webhook URL Handler component. A crafted manipulation can induce a server-side request forgery (SSRF) and is reportable remotely. The vulnerability involves unknown code within the Webhook URL Handler and, per disclosures, the vendor...

CVE-2026-5469

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-4108

creationtimestamp| type| source ---|---|--- 2026-04-03 13:19:23+00:00| seen| Telegram/QqwQTSXFRfWkuAVwlsaqg6mFQm4R2dirgmJdEmZNl5G-CtQ 2026-04-04 03:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3minakyy7ft2v...

CVE-2026-5467 Casdoor OAuth Authorization Request redirect

A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirecturi leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-35414

creationtimestamp| type| source ---|---|--- 2026-04-03 09:56:02+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3milhdeiiu22d 2026-04-27 18:30:06+00:00| seen| https://t.me/truesecator/8150 2026-04-29 07:06:34+00:00| seen|...

CVE-2025-7024

creationtimestamp| type| source ---|---|--- 2026-04-03 08:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3milbh5f5zm2i 2026-04-03 09:15:39+00:00| published-proof-of-concept| Telegram/NBs63VM2nQ9UbXE-D7ue-jsugZ5lhQP4O69jnOBlFC7zlLQ...

CVE-2026-30252

Multiple reflected cross-site scripting XSS vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codiceazienda and redurl parameters...

CVE-2026-28815

creationtimestamp| type| source ---|---|--- 2026-04-03 04:20:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikulke5wj2d 2026-04-03 15:23:03+00:00| seen| Telegram/DMrtbPbyVuvJyzUNlrr2TA99ljgvsTw1ZTHgoXyjyFD12Ec 2026-04-04 07:00:31+00:00| seen|...

GHSA-CQGF-F4X7-G6WC Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

Summary The GET /api/website/title endpoint accepts an arbitrary URL via the websiteurl query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network...