CVE-2026-5633

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5633

The CVE-2026-5633 entry concerns assafelovic gpt-researcher up to version 3.4.3, with a vulnerability in an unspecified function of the ws Endpoint. An attacker can manipulate the argument source_urls to induce server-side request forgery (SSRF), with remote exploitation possible. Public exploit ...

CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system OS command injection vulnerability exists in the netrw standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the scp://...

PT-2026-30572

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source urls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-5548

creationtimestamp| type| source ---|---|--- 2026-04-05 09:01:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miqfa6kvi42g 2026-04-05 09:15:46+00:00| published-proof-of-concept| Telegram/DODGRJWtrApuUPCkLVkjLM9fRARhGaclk9hZ8B80y7duydc 2026-04-05 09:33:07+00:00| seen|...

CVE-2026-2826

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the uploadfiles capability in the processpattern REST API endpoin...

CVE-2026-2826 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the uploadfiles capability in the processpattern REST API endpoin...

Server-side Request Forgery (SSRF)

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the parseurls API function. An attacker can access internal network resources, read local files, enumerate file existenc...

pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Vulnerability Details CWE-918: Server-Side Request Forgery SSRF The parseurls API function in src/pyload/core/api/init.py line 556 fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission...

PT-2026-30319

Name of the Vulnerable Software and Affected Versions pyLoad versions 0.5.0b3.dev96 and earlier Description pyLoad, a Python-based download manager, has an issue in the parse urls API function located in src/pyload/core/api/ init .py. This function retrieves URLs server-side using get urlurl pycu...

CVE-2026-34954

PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.downloadfile in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with followredirects=True. An attacker who controls the URL can reach any...

CVE-2026-28756

creationtimestamp| type| source ---|---|--- 2026-04-03 12:00:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3milocanjqh24 2026-04-03 12:53:33+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3milrayuqdt2g 2026-04-03 13:19:05+00:00| seen|...

CVE-2026-33105

creationtimestamp| type| source ---|---|--- 2026-04-03 01:10:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikjxjszro25 2026-04-03 01:16:28+00:00| seen| Telegram/iJ-TXq8dDjuzcBmcTa4J1ArjLXeEo9DZvpPvRg0iyulgok 2026-04-03 01:30:27+00:00| seen|...

CVE-2026-26135

creationtimestamp| type| source ---|---|--- 2026-04-03 00:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikitpnzqk2z 2026-04-03 01:16:28+00:00| seen| Telegram/iJ-TXq8dDjuzcBmcTa4J1ArjLXeEo9DZvpPvRg0iyulgok 2026-04-03 01:50:22+00:00| seen|...

PT-2026-30228

Name of the Vulnerable Software and Affected Versions prompts.chat versions prior to commit 30a8f04 Description An issue in the Fal.ai media status polling feature allows authenticated users to perform arbitrary outbound requests. By supplying attacker-controlled URLs in the token parameter, the...

RHEL 8 : python3 (RHSA-2026:6473)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:6473 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

CVE-2026-34577

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith'mp4', which is trivially bypassable by...