MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-54282

A flaw was found in Starlette, a lightweight Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.3.0, the HTTP request path was not properly validated when reconstructing the request.url. A remote attacker could craft a malicious HTTP request path that does not begin with a...

CVE-2026-13526

creationtimestamp| type| source ---|---|--- 2026-06-29 04:13:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfmryyzdh2e...

CVE-2026-13530

creationtimestamp| type| source ---|---|--- 2026-06-29 04:09:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfmjzor3l23 2026-06-29 19:54:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphbe7zq3r2d...

CVE-2026-13519

creationtimestamp| type| source ---|---|--- 2026-06-29 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpfiomtph42p 2026-06-29 04:33:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfnv4hres27 2026-06-29 12:59:29+00:00| seen|...

CVE-2026-49991

creationtimestamp| type| source ---|---|--- 2026-06-29 01:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfby6r6fp2x 2026-06-29 05:10:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpfpwvwcr226...

CVE-2026-56123

creationtimestamp| type| source ---|---|--- 2026-06-29 00:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpfaoajjhc2y...

python3.11 security update

3.11.13-10.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-10 - Depend on sqlite-libs with deserialize API Resolves: RHEL-178519...

PT-2026-53646

Summary Alice exposes a Python SDK ProxyShare with a fixed target URL. Bob sends a request to the share with an absolute URL in the path. The Flask handler passes that path to urllib.parse.urljoin, which replaces Alice's configured target host with Bob's host and returns the server-side response ...

PT-2026-53430

Impact The POST /api/v2/firefighter/raid/jira bot endpoint CreateJiraBotView is reachable without authentication permission classes = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that...

CVE-2026-11720: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...

CVE-2026-13751: Server-Side Request Forgery (SSRF)

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. B...

CVE-2026-13560: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...

CVE-2026-55844: Cleartext Transmission of Sensitive Information

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to ...

PT-2026-53251

Name of the Vulnerable Software and Affected Versions Edimax EW-7478APC version 1.04 Description An OS command injection flaw exists in the POST Request Handler component. A remote attacker can exploit this by manipulating the submit-url argument within the formAccept function of the...

PT-2026-53441

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection url property with...

PT-2026-53526

The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands...

PT-2026-53283

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2025.5.0 Description The iOS companion app fails to respect the SSID allowlist for internal networks. While the app typically uses the Service Set Identifier SSID—the public name of a wireless network—to...

Business Chat function Microsoft 365 Copilot Privilege Escalation

The vulnerability of the Business Chat function in Microsoft 365 Copilot relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...