CVE-2020-9686

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:04+00:00| seen| https://t.me/timcorehacking/946 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/946...

CVE-2020-9634

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:03+00:00| seen| https://t.me/timcorehacking/919 2026-08-06 00:00:55+00:00| seen| https://t.me/timcorehacking/919...

GHSA-CJ62-HVV2-2Q5H

creationtimestamp| type| source ---|---|--- 2026-08-05 03:31:03+00:00| seen| https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14...

GHSA-CJC9-Q5GF-327P

creationtimestamp| type| source ---|---|--- 2026-08-05 02:31:21+00:00| seen| https://gist.github.com/alon710/8b519f2c594fb49b15bc37a85db39cf9...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the PathMatcher class in...

Malicious code in @zzzgenesis00/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ad6fd0f8ef16ee23b458b541d9cdfc73147e768ec9f8676ed50b30996231813 postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host. Collected data includes hos...

SUSE CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CSRF vulnerability and missing permission checks in scm-manager

scm-manager 1.11.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

PT-2026-68295

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A Server-Side Request Forgery SSRF issue exists in the validate model provider key function for the Ollama provider. The function processes a user-supplied OLLAMA BASE URL parameter an...

PT-2026-76498

Root has patched GHSA-j4mr-9xw3-c9jx in the base64-url package for Root:npm. Multiple fixed versions available...

PT-2026-68106

Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The toggle default sorting view in common/urls.py lacks authentication wrappers such as login required or staff member required. The view redirects to a destination specified by the next ur...

PT-2026-68143

Name of the Vulnerable Software and Affected Versions Stirling-PDF affected versions not specified Description The POST /api/v1/convert/url/pdf endpoint in ConvertWebsiteToPDF.java lacks Server-Side Request Forgery SSRF protections. While the endpoint verifies that the initial URL resolves to a...

PT-2026-68170

Name of the Vulnerable Software and Affected Versions Independent Analytics plugin for WordPress versions prior to 2.15.1 Description Stored Cross-Site Scripting occurs via the not found url tracking parameter. The issue arises because the get cell content function applies urldecode after esc url...

CVE-2026-70443: Improper Privilege Management

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-71270: Server-Side Request Forgery (SSRF)

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...

CVE-2026-71240: URL Redirection to Untrusted Site

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

PT-2026-76503

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

PT-2026-68278

Name of the Vulnerable Software and Affected Versions Jenkins Horreum Plugin versions 0.16.162.v33b 4a a b 5f828 and earlier Description An issue exists where the plugin fails to set the appropriate context for credentials lookup. This allows users with Item/Configure permissions to trick Jenkins...

Linux Distros Unpatched Vulnerability : CVE-2026-53501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's HMAC validation can be bypassed due to the use of Python's .replace wh...

PT-2026-68120

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions 2.3 and later Description URL handling in the DefaultFaceletFactory function does not properly sanitize or block remote URLs. This allows an attacker to specify a URL to a remote Facelet, which the server then includes...