CVE-2026-15189

The vulnerability CVE-2026-15189 affects aerostackdev aerostack-mcp (mcp-whatsapp component). The issue is in the upload_media function where manipulation of the media_url argument enables server-side request forgery (SSRF). The records indicate the attack could be launched remotely, with no vers...

CVE-2026-15189 aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery

A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is the function uploadmedia of the component mcp-whatsapp. Such manipulation of the argument mediaurl leads to server-side request forgery. The attack ma...

Malicious code in chai-as-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58 On require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL...

CVE-2017-7253

creationtimestamp| type| source ---|---|--- 2026-07-09 15:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7vx533e625...

CVE-2026-4256

creationtimestamp| type| source ---|---|--- 2026-07-09 14:52:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7v5f3nus2i...

CVE-2026-12593

creationtimestamp| type| source ---|---|--- 2026-07-09 14:47:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7uugogut2k...

CVE-2026-15172

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-15173

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-6352

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o...

CVE-2026-8472

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o 2026-07-10 17:44:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcp7nooid2k 2026-07-10 17:44:39+00:00| seen|...

CVE-2026-58305

creationtimestamp| type| source ---|---|--- 2026-07-09 12:42:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7ntwij7b2i...

CVE-2017-2847

creationtimestamp| type| source ---|---|--- 2026-07-09 12:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7nkvy5hh2s...

CVE-2017-2846

creationtimestamp| type| source ---|---|--- 2026-07-09 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7lvbi36e2o...

CVE-2026-7830

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq7kb3luk22s...

CVE-2026-5955

creationtimestamp| type| source ---|---|--- 2026-07-09 10:52:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7hp5hsn72h...

CVE-2026-47831

creationtimestamp| type| source ---|---|--- 2026-07-09 08:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7aomhpfa2q 2026-07-09 17:36:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6cspnal2i...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-14245

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the umresetpasswordprocesshook function performing no server-side...

CVE-2026-12516

creationtimestamp| type| source ---|---|--- 2026-07-09 08:10:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76ngzyvh2x 2026-07-09 17:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6jrqqi327...

CVE-2026-8848

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an...