122863 matches found
CVE-2026-63727
creationtimestamp| type| source ---|---|--- 2026-07-28 16:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprsqvyp52o...
CVE-2026-43910
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
CVE-2026-15014
creationtimestamp| type| source ---|---|--- 2026-07-28 15:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrppqxciid2s...
CVE-2026-66920
creationtimestamp| type| source ---|---|--- 2026-07-28 15:18:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrppgfssut2i...
CVE-2026-67178
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-62423
creationtimestamp| type| source ---|---|--- 2026-07-28 15:02:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpol6b4fn24 2026-07-29 13:55:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrs3axvf5z24 2026-07-30 04:45:20+00:00| seen|...
GHSA-VG6V-J97M-H5XQ @novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Hi Novu team, Reporting an SSRF blocklist gap in the shared validateUrlSsrf guard. A complete self-contained reproduction is inlined below — copy the four files into a directory and run docker compose up, plus a single-file probe that runs against Node directly. Locally validated against HEAD...
CVE-2026-13440
creationtimestamp| type| source ---|---|--- 2026-07-28 14:42:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrpngwmbxe23 2026-07-28 17:13:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrpvv2eqdh23...
CVE-2026-58218
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-31 12:01:51+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrwvu4gbhz2t...
CVE-2026-58221
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-29 12:45:02+00:00| seen| https://www.acn.gov.it/portale/w/nuove-vulnerabilita-in-samba-1 2026-08-01 21:40:36+00:00| seen|...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
Malicious code in korvica (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...
CVE-2026-67173
Pivotick exposes a URI handling flaw in graph rendering: node imagePath values derived from graph data are not validated for their URL schemes before being assigned to SVG image resources. An attacker could supply crafted graph data to cause an image path to point to a malicious URI, and when a v...
MAL-2026-11141 Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...
CVE-2026-65882
Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...
CVE-2026-18047
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...
CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1
Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...
CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1
Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...
CVE-2026-65882
The Joomla Extension - joomdle.com is affected by a Reflected XSS vulnerability in versions prior to 3.1.1 . The issue stems from the goto url parameter within the moodle wrapper endpoint , which fails to properly neutralize input, allowing for a reflected XSS vector. Exploitation details are not...