122689 matches found
CVE-2026-17617
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
CVE-2026-15587
creationtimestamp| type| source ---|---|--- 2026-08-05 17:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzjgf4672b...
CVE-2026-71201
creationtimestamp| type| source ---|---|--- 2026-08-05 16:32:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3r2rzs5rcn4ns...
CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...
CVE-2026-70606
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
GHSA-R4W5-6PFG-JXP5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...
CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
EUVD-2026-53430
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
CVE-2026-48911
creationtimestamp| type| source ---|---|--- 2026-08-05 15:25:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4ygjgczwvv462...
Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870 On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments...
Malicious code in boxy-get-retry-url (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...
CVE-2026-17506
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...
CVE-2026-67623
creationtimestamp| type| source ---|---|--- 2026-08-05 14:15:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jze72nb5aends...
Malicious code in claims-patch-url (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....
MAL-2026-12631 Malicious code in claims-patch-url (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....
Malicious code in claims-replace-url-params (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0 The package's public API in index.js is a no-op class whose only real effect is require"./adapter" on load. adapter.js selects a platform-specific...
CVE-2026-71294
creationtimestamp| type| source ---|---|--- 2026-08-05 14:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msdot46tz22p 2026-09-13 07:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102176 2026-09-14 00:00:30+00:00| published-proof-of-concept|...