EUVD-2026-39023

Ghost: Mobiledoc image-size fetch SSRF...

CVE-2026-66901

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

GHSA-H6X2-583H-X99R Open WebUI: DNS Rebinding SSRF Bypass

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

EUVD-2026-52750

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-18754

creationtimestamp| type| source ---|---|--- 2026-08-04 09:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msanlkacge2l 2026-08-04 09:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/befdrlvqqqlb5 2026-08-04 13:32:06+00:00| seen|...

CVE-2026-16296

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

CVE-2026-10526

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

Important: aws-nitro-enclaves-cli

Issue Overview: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL doe...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2026-2034)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2034 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as...

SUSE CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-15950

creationtimestamp| type| source ---|---|--- 2026-08-01 17:39:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzz63hfnh2d 2026-08-01 17:39:18+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrzz6gz75r2n 2026-08-01 18:39:00+00:00| seen|...

CVE-2026-16614

creationtimestamp| type| source ---|---|--- 2026-08-01 17:35:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzyxryvnf2i 2026-08-01 17:36:07+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzyyqr2ya22 2026-08-01 19:00:39+00:00| seen|...

CVE-2026-14823

creationtimestamp| type| source ---|---|--- 2026-08-01 15:02:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzqfpqsbf2v 2026-08-01 15:14:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzr2yggdo2b 2026-08-01 15:14:43+00:00| seen|...