CVE-2026-3974

creationtimestamp| type| source ---|---|--- 2026-04-03 00:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mikg2a74ah2f...

PT-2026-30049

Name of the Vulnerable Software and Affected Versions Casdoor version 2.356.0 Description A weakness exists in the Webhook URL Handler component that could allow for server-side request forgery SSRF. This can be triggered remotely by manipulating the system. The vendor was contacted but did not...

prompts.chat 代码问题漏洞

prompts.chat is an open-source AI prompt library developed by Fatih Kadir Akın. Versions prior to 1464475 contained code vulnerabilities; these vulnerabilities stemmed from requests for forged server-side requests in the Wiro media generator, which could allow authenticated users to probe interna...

PraisonAI 安全漏洞

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 4.5.90 contained security vulnerabilities. These vulnerabilities stemmed from the passthrough and apassthrough functions accepting an apibase parameter controlled by the caller...

PT-2026-30007

Impact When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter ...

PT-2026-30226

Name of the Vulnerable Software and Affected Versions prompts.chat versions prior to commit 1464475 Description Authenticated users can exploit a blind server-side request forgery SSRF in the Wiro media generator. This occurs when the application performs server-side fetches of the user-controlle...

AlmaLinux 9 : grafana (ALSA-2026:6382)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:6382 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the AlmaLinux securi...

PT-2026-30015

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description The GET /api/website/title endpoint is susceptible to Server-Side Request Forgery SSRF. The endpoint accepts an arbitrary URL via the website url query parameter and makes a server-side HTTP request to ...

PT-2026-30014

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.8 Description Ech0, a self-hosted publishing platform, has an unsafe link preview feature. The GET /api/website/title endpoint is unauthenticated and accepts attacker-controlled URLs. It performs a server-side GET...

SUSE CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-35464

creationtimestamp| type| source ---|---|--- 2026-04-02 21:50:29+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j 2026-04-07 15:27:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3q27o3k2h 2026-04-07...

EUVD-2026-18550

Multiple reflected cross-site scripting XSS vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codiceazienda and redurl parameters...

CVE-2024-14034

creationtimestamp| type| source ---|---|--- 2026-04-02 21:30:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik5ocm6yt2i...

CVE-2026-34735

creationtimestamp| type| source ---|---|--- 2026-04-02 21:12:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik4nv6ywt2q 2026-04-02 22:22:27+00:00| published-proof-of-concept| Telegram/LEqzgESE2wGHUVmUGbeDXDuSp8F8SqNkH2O3nuA9SKVO2A...

CVE-2026-34834

creationtimestamp| type| source ---|---|--- 2026-04-02 21:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik45nplvv2s 2026-04-02 22:23:12+00:00| published-proof-of-concept| Telegram/qg3HF91OLRRzWQbI7Pfv-fl8vLkHd7iL-mBbLD40slyOww...

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

GHSA-7GGG-PVRF-458V OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

CVE-2024-44250

creationtimestamp| type| source ---|---|--- 2026-04-02 20:47:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3baewxf2i 2026-04-03 19:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mimhy2eask27...

GHSA-6QXF-7JX6-86FH

creationtimestamp| type| source ---|---|--- 2026-04-02 20:13:40+00:00| seen| https://bsky.app/profile/timb.me.uk/post/3mijzewh7atc2...

CVE-2026-35405

creationtimestamp| type| source ---|---|--- 2026-04-02 19:44:52+00:00| published-proof-of-concept| https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59 2026-04-02 19:44:52+00:00| published-proof-of-concept|...