ChurchCRM - API Authentication Bypass via URL Injection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public id: CVE-2026-39339 info: name:...

WordPress User Messages <= 1.2.4 - Reflected XSS

WordPress User Messages plugin = 1.2.4 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to load a...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-19373

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to...

CVE-2026-19373

CVE-2026-19373 affects PhialsBasement KoboldCPP-MCP-Server 1.0.0. The issue is in the function makeRequest of src/index.ts within the BaseConfigSchema component, where manipulating the argument apiUrl can lead to server-side request forgery. The advisory notes that exploitation can be launched ag...

CVE-2026-65551

creationtimestamp| type| source ---|---|--- 2026-08-09 21:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msoizjv7sf2i 2026-08-10 17:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msqm3cst432j...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

EUVD-2026-54887

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-47660

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...

CVE-2026-48094

CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp-&gt;reques...

CVE-2026-12261

creationtimestamp| type| source ---|---|--- 2026-08-07 08:31:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h7abmppp3qpxc...

Fedora 43 : curl (2026-097fb2e7e9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-097fb2e7e9 advisory. - fix cross-proxy Digest auth state leak CVE-2026-7168 - fix cross-origin Digest auth state leak CVE-2026-11856 - fix password leak with netrc and...

EUVD-2026-54081

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...

CVE-2026-16268

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts...

Linux Distros Unpatched Vulnerability : CVE-2026-71212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned...

EulerOS 2.0 SP15 : mutt (EulerOS-SA-2026-2898)

According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes truncates the hashpasswd by one byte for IMAP authcram MD5 digest.CVE-2026-43860 mutt before 2.3.2 has an infinite loop ...

CVE-2026-66881

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-17617

IBM Application Gateway Operator (versions 22.2–26.06) is affected by a Server-Side Request Forgery (SSRF) due to insufficient validation of URLs in custom resources. The issue is documented across multiple sources (NVD entry and IBM security bulletin), with the IBM bulletin listing CVSS v3.1 bas...

CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...