CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CERTFR-2026-ALE-007

creationtimestamp| type| source ---|---|--- 2026-07-20 08:52:24+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116951452309188132...

CVE-2026-13147 Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...

CVE-2026-16211

creationtimestamp| type| source ---|---|--- 2026-07-19 08:06:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqyd3tl5li2b...

CVE-2026-16133

creationtimestamp| type| source ---|---|--- 2026-07-18 20:19:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqx3moyuxa2q...

CVE-2026-50274

creationtimestamp| type| source ---|---|--- 2026-07-18 05:01:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvicwsojf2f 2026-07-19 14:01:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqywwbtptl2t 2026-07-19 14:01:07+00:00| seen|...

PT-2026-60974

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw net get/claw net post of the file claw/tools/tool net.c of the component http request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

CVE-2026-8635

creationtimestamp| type| source ---|---|--- 2026-07-17 20:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulmgjig62e 2026-07-17 22:26:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqusa6knt62e 2026-07-18 11:01:02+00:00| seen|...

CVE-2026-15093

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...

EUVD-2026-45299

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...

CVE-2026-15093 Multiple Vulnerabilities in IBM Engineering AI hub.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs...

CVE-2026-15322

CVE-2026-15322 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, where session tokens exposed in URLs could allow a remote attacker to obtain sensitive information. The IBM Security Bulletin confirms this issue under CVE-2026-15322 and states remediation is available in IBM Enginee...

CVE-2026-7667

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header e.g., filename="../../../target/path" , enabling arbitrary file write operations with...

UBUNTU-CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

EUVD-2026-45174

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...

CVE-2024-23567

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local...

Sensitive Information Disclosure

Composer is vulnerable to Sensitive Information Disclosure. The vulnerability is due to insufficient sanitization of username-only URL credentials in debug output, which allows an attacker to expose embedded credentials such as access tokens when Composer is run with verbose debugging enabled...

CVE-2026-62231

creationtimestamp| type| source ---|---|--- 2026-07-17 03:33:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqssvvbovb2s...

CVE-2026-62386 Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...