https://db.gcve.eu/sightings/feed 2026-07-22T19:48:30.990220+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/9563bd13-441f-47f8-9ab5-b52cf9e38a18/export 2026-07-22T19:48:31.005235+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "9563bd13-441f-47f8-9ab5-b52cf9e38a18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2020-26296", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqic67endd25", "content": "", "creation_timestamp": "2026-07-12T23:07:07.197368Z"} 2026-07-12T23:07:07.197368+00:00 https://db.gcve.eu/sighting/57b9ec02-c255-4e1f-becb-fefb21cc50ba/export 2026-07-22T19:48:31.006271+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "57b9ec02-c255-4e1f-becb-fefb21cc50ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26299", "type": "seen", "source": "https://t.me/cibsecurity/23364", "content": "\u203c CVE-2020-26299 \u203c\n\nftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, CWD and UPDR. When windows separators exist within the path (`\\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. The issue is patched in version 4.4.0 (commit 457b859450a37cba10ff3c431eb4aa67771122e3).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-10T20:41:34.000000Z"} 2021-02-10T20:41:34+00:00 https://db.gcve.eu/sighting/e65576b2-5edc-49e5-8ac2-107ca1ed9c02/export 2026-07-22T19:48:31.007195+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "e65576b2-5edc-49e5-8ac2-107ca1ed9c02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26295", "type": "seen", "source": "https://t.me/cibsecurity/22487", "content": "\u203c CVE-2020-26295 \u203c\n\nOpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-21T16:28:13.000000Z"} 2021-01-21T16:28:13+00:00 https://db.gcve.eu/sighting/293aa86c-d2b6-4197-bf24-4264e712111f/export 2026-07-22T19:48:31.007278+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "293aa86c-d2b6-4197-bf24-4264e712111f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26298", "type": "seen", "source": "https://t.me/cibsecurity/21914", "content": "\u203c CVE-2020-26298 \u203c\n\nRedcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-11T22:46:14.000000Z"} 2021-01-11T22:46:14+00:00 https://db.gcve.eu/sighting/55ebd8fd-21f1-4f5e-802d-448cf8fd182d/export 2026-07-22T19:48:31.007337+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "55ebd8fd-21f1-4f5e-802d-448cf8fd182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26297", "type": "seen", "source": "https://t.me/cibsecurity/21556", "content": "\u203c CVE-2020-26297 \u203c\n\nmdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-04T23:25:10.000000Z"} 2021-01-04T23:25:10+00:00 https://db.gcve.eu/sighting/65ba464c-a833-4095-9999-f27fd69f968c/export 2026-07-22T19:48:31.007391+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "65ba464c-a833-4095-9999-f27fd69f968c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26294", "type": "seen", "source": "https://t.me/cibsecurity/21555", "content": "\u203c CVE-2020-26294 \u203c\n\nVela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-04T23:25:09.000000Z"} 2021-01-04T23:25:09+00:00 https://db.gcve.eu/sighting/3c5c432b-0c9f-4b90-8de7-ccda2d0a5174/export 2026-07-22T19:48:31.007443+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "3c5c432b-0c9f-4b90-8de7-ccda2d0a5174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26293", "type": "seen", "source": "https://t.me/cibsecurity/21554", "content": "\u203c CVE-2020-26293 \u203c\n\nHtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `` tag so there is no risk if you have not explicitly allowed the `` tag. The problem has been fixed in version 5.0.372.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-04T23:25:09.000000Z"} 2021-01-04T23:25:09+00:00 https://db.gcve.eu/sighting/16527282-4251-4687-b142-0b9883754f66/export 2026-07-22T19:48:31.007493+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "16527282-4251-4687-b142-0b9883754f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26290", "type": "seen", "source": "https://t.me/cibsecurity/21363", "content": "\u203c CVE-2020-26290 \u203c\n\nDex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-28T22:28:49.000000Z"} 2020-12-28T22:28:49+00:00