CVE-2026-10668

creationtimestamp| type| source ---|---|--- 2026-07-12 17:38:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqhprwyn4c2z 2026-07-12 19:42:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqhwq52yrt2l...

GHSA-6FFX-8HJJ-JHHF

creationtimestamp| type| source ---|---|--- 2026-07-12 17:21:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqhotdnxkt22...

Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

Server-side Request Forgery (SSRF)

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ToolsRoute.testmcpconnection function. An attacker can make unauthorized requests to internal or external systems by supplying crafted input to the...

GHSA-3GJH-29FV-8HR6

creationtimestamp| type| source ---|---|--- 2026-07-12 12:51:29+00:00| seen| https://gist.github.com/MattHintz/18acc078a9239f65f06d48e0e8ada1e3...

CVE-2026-15499

creationtimestamp| type| source ---|---|--- 2026-07-12 12:35:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6vl7eaj2x 2026-07-13 21:22:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkmshvwml2y 2026-07-14 00:38:47+00:00| seen|...

CVE-2026-61874

creationtimestamp| type| source ---|---|--- 2026-07-12 12:34:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6sys2qc2e 2026-07-14 01:00:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkyxtlm5b2w 2026-07-16 08:14:49+00:00| seen|...

EUVD-2026-43237

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.testmcpconnection of the file astrbot/dashboard/routes/tools.py of the component MCP Test Endpoint. The manipulation of the argument mcpserverconfig.url leads to...

CVE-2026-56259

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by...

CVE-2026-56259 Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by...

CVE-2026-56259 Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by...

CVE-2026-15493

creationtimestamp| type| source ---|---|--- 2026-07-12 11:34:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh3hhkogs2f 2026-07-13 21:01:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkllvl44d2w...

CVE-2026-15478

creationtimestamp| type| source ---|---|--- 2026-07-12 05:32:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqghalhba72e 2026-07-12 07:44:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqgoluie5z24...

CVE-2026-5435

creationtimestamp| type| source ---|---|--- 2026-07-11 17:20:42+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mqf6dud3zz25...

GHSA-FJ8F-M44G-C479

creationtimestamp| type| source ---|---|--- 2026-07-11 17:11:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqf5tmpidk2j 2026-10-08 12:34:17+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mxehtmrzbl2i...

CVE-2026-56240

creationtimestamp| type| source ---|---|--- 2026-07-11 14:39:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqeve5iuvl2x 2026-07-12 11:39:49+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mqh3qwdo2326...

CVE-2026-56372

creationtimestamp| type| source ---|---|--- 2026-07-11 14:38:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqevco3uzu26 2026-07-11 15:40:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqeyqtibnl27 2026-07-14 10:40:04+00:00| seen|...

CVE-2026-61428

creationtimestamp| type| source ---|---|--- 2026-07-11 14:35:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqev3wf3rx2a 2026-07-11 16:17:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqf2swit5a26 2026-10-07 14:06:56+00:00| published-proof-of-concept|...

CVE-2026-61454 Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

CVE-2026-12103

creationtimestamp| type| source ---|---|--- 2026-07-11 07:34:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5lme3vf27 2026-07-11 08:27:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqeak6gj4c2z...