GHSA-JV2H-4P9V-WF5W

creationtimestamp| type| source ---|---|--- 2026-06-19 16:11:36+00:00| seen| https://gist.github.com/alon710/27a1a02d7c391b1b2590b0cf7da6fc5e...

CVE-2020-37253

creationtimestamp| type| source ---|---|--- 2026-06-19 16:09:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monq44fjfy2h...

CVE-2026-12620 Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2026-12620

The CVE affects GridTime 3000 GNSS Time Server versions 1.0r0.03 through 1.1r0.0, where an access token is leaked in the URL parameters of certain endpoints. The issue is documented by NVD/CVE entries for CVE-2026-12620, with an attack surface described as NETWORK, requiring HIGH privileges and A...

CVE-2026-12620

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

EUVD-2026-38041

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2026-12620 Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2009-4912

creationtimestamp| type| source ---|---|--- 2026-06-19 15:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monocdn2et2f...

CVE-2026-49871

creationtimestamp| type| source ---|---|--- 2026-06-19 15:25:52+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3monnobmqmq2v 2026-06-20 09:38:14+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116781763259383270 2026-08-23 17:25:03+00:00| seen|...

CVE-2016-20093

creationtimestamp| type| source ---|---|--- 2026-06-19 15:23:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monnjjbmqj2k...

GHSA-VMHF-C436-HXJ4 JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

A malicious PyPI package can place a javascript: URL in its project.urls metadata. JupyterLab's Extension Manager renders this as the extension's home-page link without validating the protocol, so a user who clicks the extension name executes attacker-controlled JavaScript in the JupyterLab origi...

Cross-site Scripting (XSS)

Overview @jupyterlab/extensionmanager is a JupyterLab - Extension Manager Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized handling of the homepageurl field in the extension manager. An attacker can execute arbitrary JavaScript in the context of the...

CVE-2010-2451

creationtimestamp| type| source ---|---|--- 2026-06-19 15:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monmmqv54g2t...

MAL-2026-6218 Malicious code in chai-as-attested (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e27467366a90f482eb47476458b1f74d5a41ac63371572e527f2e60e4e0b51 Package impersonates a pino-style logger exports module.exports.pino, ships pino-like DEFAULTLEVELS, keywords fast/logger/stream/json but the exporte...

CVE-2026-39999

creationtimestamp| type| source ---|---|--- 2026-06-19 14:25:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3monkbmgnwz2z 2026-06-21 15:33:01+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mosoyvi5jr2z 2026-06-21 16:31:02+00:00| seen|...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

GHSA-37PM-83G7-R22V canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Summary In affected versions, the OAuth2 token request sends appid, appsecret, refreshtoken and code as URL query parameters of the POST request to https://oauth./oauth/api/oauth2/token. Request URLs are commonly recorded in access logs, proxy logs and APM traces, so the application secret and...

Use of GET Request Method With Sensitive Query Strings

Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the process of handling OAuth2 token requests, where sensitive credentials such as appid, appsecret, refreshtoken, and code are included in the URL query string and exception...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildRequestUrl function. An attacker can access or modify unintended API endpoints by supplying crafted path variables containing special characters, which are inserted into the request URL...