CVE-2026-53900

creationtimestamp| type| source ---|---|--- 2026-06-16 14:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxrmn5go2g 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...

Malicious code in wordpad-text-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...

MAL-2026-5885 Malicious code in wordpad-text-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...

CVE-2026-52711

creationtimestamp| type| source ---|---|--- 2026-06-16 14:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofxjkmt4c2n...

GHSA-934W-87QH-QR26 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Summary did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying element. When an application binds attacker-controlled input a query parameter, a CMS field, a user-supplied profile URL to or :href, the attacker can...

EUVD-2026-36428

Nuxt: Reflected XSS in via unsanitised javascript: or data: URL...

NPM: Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

NPM: Nuxt: URL-handling weaknesses in navigateTo and reloadNuxtApp: SSR open redirect, client-side script execution via the open option, and protocol-relative bypass in reloadNuxtApp vulnerability discovered by ? in WordPress Npm nuxt versions 3.21.7...

CVE-2026-9072

creationtimestamp| type| source ---|---|--- 2026-06-16 12:50:05+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3moftkwzfkl2p 2026-06-22 20:01:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movoil2zvk2q 2026-06-24 01:02:15+00:00| seen|...

CVE-2017-20223

creationtimestamp| type| source ---|---|--- 2026-06-16 12:37:17+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mofstqurim2f...

CVE-2025-52194

creationtimestamp| type| source ---|---|--- 2026-06-16 12:12:40+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mofrhwpip22x 2026-06-16 12:12:41+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mofrhyf5ik2x...

BIT-MARIADB-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP...

CVE-2026-8444

creationtimestamp| type| source ---|---|--- 2026-06-16 09:27:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofibk2zkh2g 2026-06-16 17:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogbll4sir2c...

CVE-2026-6964

creationtimestamp| type| source ---|---|--- 2026-06-16 07:37:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofc4ombc72m...

CVE-2026-53828

creationtimestamp| type| source ---|---|--- 2026-06-16 04:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moexzfti3f2v...

[SECURITY] Fedora 44 Update: perl-Mojo-JWT-1.02-1.fc44

JSON Web Token is described in https://tools.ietf.org/html/rfc7519. Mojo::JWT implements that standard with an API that should feel familiar to Mojolicious users though of course it is useful elsewhere. Indeed, JWT is much like Mojolicious::Sessions except that the result is a URL-safe text strin...

CVE-2026-48599

creationtimestamp| type| source ---|---|--- 2026-06-16 00:15:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moejf54fro22 2026-08-25 20:35:28+00:00| published-proof-of-concept| https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq 2026-08-26 10:31:32+00:00|...

PT-2026-53031

Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused to exfiltrate server-held secrets. The Docker API is unauthenticated by default. Vector 1 - attacker base url /md, /llm, and /llm/job...

CVE-2026-12425: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...

RHEL 9 : podman (RHSA-2026:26445)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26445 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...

CVE-2026-47684: Server-Side Request Forgery (SSRF)

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses e.g. ::ffff:127.0.0.1, allowing SSRF protection to be bypassed ...