EUVD-2026-49574

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-65618 Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-66028

creationtimestamp| type| source ---|---|--- 2026-07-27 19:22:02+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmljfshn2c...

CVE-2026-64648 Next.js: Response Body Cache Confusion for Requests Containing Bodies

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

GHSA-PM35-FQVH-CQ5G

creationtimestamp| type| source ---|---|--- 2026-07-27 19:17:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmdahelz2n...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-63077

creationtimestamp| type| source ---|---|--- 2026-07-27 18:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnidphmxq2j 2026-07-28 09:00:06+00:00| seen| https://t.me/thehackernews/9631 2026-07-28 10:00:53+00:00| seen|...

CVE-2026-61487

creationtimestamp| type| source ---|---|--- 2026-07-27 18:03:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrni7yb6hz22 2026-07-28 14:58:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpocvshb32e...

CVE-2026-59528

creationtimestamp| type| source ---|---|--- 2026-07-27 18:02:46+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrni5sssge26 2026-08-12 10:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msuvk6bu7g2l...

CVE-2026-59878

creationtimestamp| type| source ---|---|--- 2026-07-27 17:48:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrnhf5ejkf2n 2026-07-28 15:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpr2tprhh2i 2026-07-28 16:01:00+00:00| seen|...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623

PostCSS vulnerability CVE-2026-45623 affects versions up to 8.5.11. The PreviousMap parses the /*# sourceMappingURL=PATH */ comment from CSS, dereferencing PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker-controlled CSS input can cause the host process...

EUVD-2026-49376

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-66390

creationtimestamp| type| source ---|---|--- 2026-07-27 16:48:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrndzrqhm622...

CVE-2026-66390

The Apache Wicket Java web application framework is vulnerable to Cross-site Scripting (XSS) due to improper input neutralization during web page generation. Specifically, the wicket-core component fails to properly escape JavaScript when generating code for Link, ExternalLink, and PopupSettings....

CVE-2026-59550

creationtimestamp| type| source ---|---|--- 2026-07-27 16:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbxujvm524 2026-08-12 14:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msvcxdahlj2i 2026-09-18 04:00:13+00:00| seen|...

CVE-2026-59527

creationtimestamp| type| source ---|---|--- 2026-07-27 16:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbqqrma52q 2026-08-11 13:16:13+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mssp53f5fd26...