CVE-2026-58158

creationtimestamp| type| source ---|---|--- 2026-08-06 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgjpi53yw2r...

CVE-2026-3430

creationtimestamp| type| source ---|---|--- 2026-08-06 17:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgjehd5472n...

CVE-2026-71446

The CVE-2026-71446 vulnerability affects the AIL Framework, specifically the crawler domain view where crawled URLs are embedded directly into a JavaScript onclick handler for the stored screenshot feature. The root cause is inadequate encoding of the stored URL, allowing an attacker to inject Ja...

CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

CVE-2026-70637

creationtimestamp| type| source ---|---|--- 2026-08-06 16:14:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dfebd4n6mb6sx...

CVE-2026-65573

creationtimestamp| type| source ---|---|--- 2026-08-06 16:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggn3kn6l2m...

CVE-2026-65553

creationtimestamp| type| source ---|---|--- 2026-08-06 16:08:30+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggfx7l7n2p 2026-08-10 08:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspnvqxdlh2r 2026-08-11 04:16:08+00:00| seen|...

CVE-2026-65546

creationtimestamp| type| source ---|---|--- 2026-08-06 16:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggcd7m3t2o 2026-08-12 00:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msttzaxsnp2a...

CVE-2026-70646

creationtimestamp| type| source ---|---|--- 2026-08-06 16:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgfza4pbj2n...

CVE-2026-65520

creationtimestamp| type| source ---|---|--- 2026-08-06 15:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfqjds452f 2026-08-06 23:14:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msh67njzkv26 2026-08-06 23:14:06+00:00| seen|...

CVE-2026-28139

creationtimestamp| type| source ---|---|--- 2026-08-06 15:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfmvphqq2m...

CVE-2026-53975

creationtimestamp| type| source ---|---|--- 2026-08-06 15:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfjd25gq22...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18427

creationtimestamp| type| source ---|---|--- 2026-08-06 14:59:17+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3msgckuh2w226 2026-08-06 20:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgtfyoa4h2n...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

EEF-CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Summary Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to...