HackerOne Bug Bounty Disclosure: -click-account-takeover-via-open-redirect-through-regex-bypass-in-domain-validation-farr - https://www.redpacketsecurity.com/hackerone-bugbounty-disclosure-click-account-takeover-via-open-redirect-through-regex-bypass-in-domain-validation-farr/

#HackerOne #CVE #Vulnerability #OSINT #ThreatIntel #Cyber

CVE-2026-48773 - Critical RCE in Proxysql. Pre-auth heap memory corruption via oversized packet. CVSS 9.8. Patch to v3.0.9 immediately. #CVE #infosec #Proxysql

https://www.valtersit.com/cve/CVE-2026-48773/

🚨 EUVD-2024-55642

📊 Score: 9.3/10 (CVSS v3.1)
📦 Product: Flowise
🏢 Vendor: Flowise
📅 Updated: 2026-06-20

📝 Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55642

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38112

📊 Score: 2.3/10 (CVSS v3.1)
📦 Product: nuxt, nuxt
🏢 Vendor: nuxt
📅 Updated: 2026-06-20

📝 Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38112

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38113

📊 Score: 2.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-06-20

📝 Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character a...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38113

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2025-210289

📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: Flowise
🏢 Vendor: Flowise
📅 Updated: 2026-06-20

📝 Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javasc...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210289

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38114

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-06-20

📝 Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical locatio...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38114

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38115

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-06-20

📝 Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend perfo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38115

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38116

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-06-20

📝 Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum p...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38116

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-38117

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-06-20

📝 Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or permission checks. An unauth...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38117

#cybersecurity #infosec #euvd #cve #vulnerability