649 matches found
CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...
CVE-2026-58156
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...
CVE-2026-58156
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...
BMC FootPrints 'searchWeb' - Server-Side Request Forgery
BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/import/searchWeb endpoint. The 'url' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling acces...
mcp-atlassian < 0.17.0 - Server-Side Request Forgery
MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...
CVE-2026-54690 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...
CVE-2026-65925
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...
CVE-2026-65925
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...
PT-2026-65113
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...
CVE-2026-57106
creationtimestamp| type| source ---|---|--- 2026-07-24 15:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfpdryc7w2y 2026-07-24 17:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrftcvc72z2j 2026-07-25 06:14:27+00:00| seen|...
EUVD-2026-47914
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...
CVE-2026-15957
creationtimestamp| type| source ---|---|--- 2026-07-21 22:09:29+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr6t5gpv222u 2026-07-21 23:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6y3aa3s22i 2026-07-22 13:13:56+00:00| seen|...
OESA-2026-2999 xdg-desktop-portal security update
xdg-desktop-portal works by exposing a series of D-Bus interfaces known as portals under a well-known name org.freedesktop.portal.Desktop and object path /org/freedesktop/portal/desktop. The portal interfaces include APIs for file access, opening URIs, printing and others. Security Fixes:...
CVE-2026-45368
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...
CVE-2026-45368
Kirby CMS is affected in versions prior to 4.9.1 and 5.4.1 by an XSS in URL handling for several first‑party renderers that emit : the (link: …) KirbyTag, the link parameter of (image: …), the image block's link field, and the HTML importer for blocks. The underlying issue does not filter dangero...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a...
CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...
PYSEC-2026-2427 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. Finding 1 Critical: SSRF CWE-918 The HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to...
CVE-2026-57770
creationtimestamp| type| source ---|---|--- 2026-07-13 10:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjiyawyja25 2026-07-13 11:26:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlhmqfs62r...