CVE-2026-55471

creationtimestamp| type| source ---|---|--- 2026-06-17 13:06:00+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf 2026-07-08 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64rso5sc2z...

Malicious code in @mastra/github-signals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e263abbd9ed9975f3f8aaecfd1a780616bc3aef00238ed9ba9075b5bf4e38f37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

GHSA-63HW-FMQ6-XXG2 vulnerabilities

Vulnerabilities for packages: open-webui, airflow, mlflow...

GHSA-9X8Q-7H8H-WCW9 vulnerabilities

Vulnerabilities for packages: open-webui, airflow, mlflow...

CVE-2026-54069

creationtimestamp| type| source ---|---|--- 2026-06-17 04:18:47+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-54069.yaml 2026-07-10 19:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcwdmy6ok2t 2026-07-10...

CVE-2026-55450

creationtimestamp| type| source ---|---|--- 2026-06-17 03:40:00+00:00| published-proof-of-concept| https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735 2026-06-22 00:56:19+00:00| seen| https://bsky.app/profile/kitafox.bsky.social/post/3motoi5iyzb2k 2026-06-27...

SUSE CVE-2026-32737

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...

SUSE CVE-2026-32805

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the sanitizeArchivePath function in webserver/api/v1/decoder.go lines 80-88 is vulnerable to a path...

PT-2026-50562

Name of the Vulnerable Software and Affected Versions github workflows affected versions not specified Description The github workflows module constructs local directory paths using repository names provided by the user without validating for symlinks. A local attacker with access to the scan...

CVE-2026-44644: Improper Neutralization of Input During Web Page Generation

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in the striphtml filter logic. The striphtml filter is intended to remove HTML tags from a string before rendering, and is widely used as an XS...

CVE-2026-45617: Inefficient Regular Expression Complexity

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in striphtml filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many...

Security Update for Microsoft Visual Studio Code (June 2026)

The version of Microsoft Visual Studio Code installed on the remote Windows host is prior to 1.123.2. It is, therefore, affected by multiple vulnerabilities: - Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. CVE-2026-47281 -...

GO-2026-5054 Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel...

GO-2026-5055 File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser...

CVE-2026-55091

creationtimestamp| type| source ---|---|--- 2026-06-16 22:51:04+00:00| published-proof-of-concept| https://github.com/joaonuno/flat-to-nested-js/security/advisories/GHSA-hp36-v28f-w3r4...

GHSA-69QJ-PVH9-C5WG

creationtimestamp| type| source ---|---|--- 2026-06-16 22:41:17+00:00| seen| https://gist.github.com/alon710/2d3358848147c1728694a3629d631316 2026-06-16 23:01:53+00:00| seen| https://gist.github.com/alon710/67012fd2d01a0b46570236682933fc3c...

CVE-2026-54905

creationtimestamp| type| source ---|---|--- 2026-06-16 21:35:27+00:00| published-proof-of-concept| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp...

GHSA-WWFH-H76J-FC44

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

GHSA-9X8Q-7H8H-WCW9 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, airflow-core, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-13.0, awx, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, py3.13-scanner-test-libraries-aiohttp, py3-vllm-cuda-12.4, dask-kubernetes-fips,...