GHSA-VMHF-C436-HXJ4 JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

A malicious PyPI package can place a javascript: URL in its project.urls metadata. JupyterLab's Extension Manager renders this as the extension's home-page link without validating the protocol, so a user who clicks the extension name executes attacker-controlled JavaScript in the JupyterLab origi...

Cross-site Scripting (XSS)

Overview @jupyterlab/extensionmanager is a JupyterLab - Extension Manager Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized handling of the homepageurl field in the extension manager. An attacker can execute arbitrary JavaScript in the context of the...

CVE-2010-2451

creationtimestamp| type| source ---|---|--- 2026-06-19 15:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monmmqv54g2t...

MAL-2026-6218 Malicious code in chai-as-attested (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e27467366a90f482eb47476458b1f74d5a41ac63371572e527f2e60e4e0b51 Package impersonates a pino-style logger exports module.exports.pino, ships pino-like DEFAULTLEVELS, keywords fast/logger/stream/json but the exporte...

CVE-2026-39999

creationtimestamp| type| source ---|---|--- 2026-06-19 14:25:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3monkbmgnwz2z 2026-06-21 15:33:01+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mosoyvi5jr2z 2026-06-21 16:31:02+00:00| seen|...

GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

Use of GET Request Method With Sensitive Query Strings

Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the process of handling OAuth2 token requests, where sensitive credentials such as appid, appsecret, refreshtoken, and code are included in the URL query string and exception...

GHSA-37PM-83G7-R22V canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Summary In affected versions, the OAuth2 token request sends appid, appsecret, refreshtoken and code as URL query parameters of the POST request to https://oauth./oauth/api/oauth2/token. Request URLs are commonly recorded in access logs, proxy logs and APM traces, so the application secret and...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildRequestUrl function. An attacker can access or modify unintended API endpoints by supplying crafted path variables containing special characters, which are inserted into the request URL...

CVE-2026-48934

creationtimestamp| type| source ---|---|--- 2026-06-19 13:45:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c 2026-06-21 19:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260622 2026-06-26 03:06:10+00:00| seen|...

CVE-2026-48931

creationtimestamp| type| source ---|---|--- 2026-06-19 13:45:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c 2026-06-21 19:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260622 2026-06-23 13:41:44+00:00| seen|...

CVE-2026-12706

creationtimestamp| type| source ---|---|--- 2026-06-19 12:29:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monds67tmg2k...

CVE-2026-6798

creationtimestamp| type| source ---|---|--- 2026-06-19 11:49:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monbll4lbt2k...

CVE-2015-0545

creationtimestamp| type| source ---|---|--- 2026-06-19 11:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monav6j4ks2f...

Exploit for Improper Authorization in Apache Tomcat

CVE-2026-43515 — Apache Tomcat Security Constraint Bypass...

GHSA-RWP6-7W3Q-75FQ

creationtimestamp| type| source ---|---|--- 2026-06-19 09:41:32+00:00| seen| https://gist.github.com/alon710/ce6be6956edb730f85105a449ccea809...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-27142 DESCRIPTION: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an...

CVE-2026-9822

creationtimestamp| type| source ---|---|--- 2026-06-19 07:49:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3momu5zpw4j2h...

CVE-2026-10735

creationtimestamp| type| source ---|---|--- 2026-06-19 07:16:13+00:00| seen| https://bsky.app/profile/ahmandonk.bsky.social/post/3momscoqoae2v 2026-07-13 13:00:07+00:00| seen| https://t.me/truesecator/8322 2026-07-14 00:00:43+00:00| exploited| https://t.me/truesecator/8322 2026-09-25...