CVE-2026-39031

creationtimestamp| type| source ---|---|--- 2026-06-29 20:02:51+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mphbsqpagi2y 2026-06-29 21:41:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphhdtfuob2e 2026-07-13 22:00:21+00:00| seen|...

GHSA-VWXW-JRG6-9JXV

creationtimestamp| type| source ---|---|--- 2026-06-29 19:31:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116835056501762471...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the rule ID path parameter of the alert-history endpoints. An attacker can execute arbitrary database queries and access sensitive data by injecting specially crafted input. This may also allow the attacker to perform...

CVE-2026-54889

Improper Neutralization of Input During Web Page Generation XSS vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':todelta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':defaultconvertnode/3 in...

CVE-2026-54889

Summary: CVE-2026-54889 security issue in Elixir.MDEx.mdex Delta conversion path allows XSS via unsanitized URL schemes in Quill Delta output. The vulnerability arises when Elixir.MDEx.DeltaConverter.default_convert_node/3 copies the URL from link, wikilink, or image nodes into the Delta attribut...

EEF-CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to\delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default\convert\node/3...

CVE-2026-57958

creationtimestamp| type| source ---|---|--- 2026-06-29 19:09:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph6tdx2xt22 2026-06-29 21:24:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphgf7rael2y...

CVE-2026-57946

creationtimestamp| type| source ---|---|--- 2026-06-29 18:53:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5w56s7h2g 2026-06-29 21:17:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphfxm2eap2k...

CVE-2025-70101

creationtimestamp| type| source ---|---|--- 2026-06-29 18:53:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mph5vwj3n22g...

CVE-2026-57950

creationtimestamp| type| source ---|---|--- 2026-06-29 18:49:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5pretwz23 2026-06-29 21:57:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphi75nrkv2n 2026-06-29 22:25:35+00:00| seen|...

CVE-2026-56780

creationtimestamp| type| source ---|---|--- 2026-06-29 18:46:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5k4naqc2n...

CVE-2026-57948

creationtimestamp| type| source ---|---|--- 2026-06-29 18:35:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph4vqqetc2b 2026-06-29 21:28:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphglkar5j2e...

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...

GHSA-VWXW-JRG6-9JXV MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...

CVE-2026-54231

creationtimestamp| type| source ---|---|--- 2026-06-29 18:16:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph3vg2wcb2d...

CVE-2026-57955

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-56285

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including...

CVE-2026-11720

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...

CVE-2026-13590

creationtimestamp| type| source ---|---|--- 2026-06-29 17:51:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2ilx2mu2d 2026-06-29 19:56:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphbh5w62h2x 2026-06-29 20:42:39+00:00| seen|...

CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...