CVE-2026-53594

creationtimestamp| type| source ---|---|--- 2026-07-20 22:06:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4cjglmhe2s...

EUVD-2026-39180

shell-quote: Quadratic-complexity Denial of Service in parse CWE-407...

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap ordered map tag. The omapTag.addItem function performs a linear On scan for duplicate key detection on every insertion, resulting in On^2 total time to parse a document with n omap entries. An attacker can send a small crafted...

EUVD-2026-40269

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups...

CVE-2026-53595

creationtimestamp| type| source ---|---|--- 2026-07-20 20:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr45zei2rd2u 2026-07-20 21:59:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4c4cmak22e 2026-07-20 22:00:43+00:00| seen|...

GHSA-499R-G7PC-VMP9

creationtimestamp| type| source ---|---|--- 2026-07-20 20:32:00+00:00| seen| https://gist.github.com/alon710/4520df6a85d072915e787e3825f8e5ef...

CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path the Codex CLI shim. This...

CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path host-tool-mcp.mjs. This allows untrusted code executing in the...

CVE-2026-64651

The CVE-2026-64651 entry concerns the @ai-sdk/harness-opencode tool that connects HarnessAgent to OpenCode via a sandboxed bridge. Before version 1.0.28, the tool would relay requests from any process whose command line included an allowed helper script path (host-tool-mcp.mjs), enabling untruste...

GHSA-GCJP-F7JM-RRRG

creationtimestamp| type| source ---|---|--- 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e...

GHSA-C98P-7WGM-6P64 Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...

Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...

CVE-2026-57366

creationtimestamp| type| source ---|---|--- 2026-07-20 18:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3x7e2xlx2e 2026-07-21 04:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4yq7e34e2o 2026-07-21 14:44:09+00:00| seen|...

CVE-2026-51385

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:05+00:00| seen| Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM 2026-07-21 00:00:32+00:00| seen| Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM 2026-07-22 00:00:07+00:00| published-proof-of-concept|...

CVE-2026-57356

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3qiss5gu2n 2026-07-21 02:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4rzmvp3q2j 2026-07-21 12:44:08+00:00| seen|...

aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-57349

creationtimestamp| type| source ---|---|--- 2026-07-20 14:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3js6prby2q 2026-07-21 00:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4lczxpok23 2026-07-21 10:44:09+00:00| seen|...

Exploit for Confused Deputy in Apache Camel

camel-dapr Consumer Routing-Header Override / Confused Deputy...

CVE-2026-12970

creationtimestamp| type| source ---|---|--- 2026-07-20 08:55:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2wc3gzwr2i...

CERTFR-2026-ACT-031

creationtimestamp| type| source ---|---|--- 2026-07-20 08:34:42+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mr2v5ko7qq2g 2026-07-20 08:51:10+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w2zlyeq2b 2026-07-20 08:51:16+00:00| seen|...