CVE-2026-7329

creationtimestamp| type| source ---|---|--- 2026-08-05 17:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzmyv47p2b 2026-08-06 12:43:03+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msg2xcrimm2x 2026-08-06 16:15:42+00:00| seen|...

CVE-2026-15573

creationtimestamp| type| source ---|---|--- 2026-08-05 16:59:43+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msdytdptqw22 2026-08-05 23:02:49+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117045393405816451 2026-08-05 23:02:49+00:00| seen|...

CVE-2026-12410

creationtimestamp| type| source ---|---|--- 2026-08-05 16:57:47+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msdypuyg4422...

CVE-2026-20303

creationtimestamp| type| source ---|---|--- 2026-08-05 16:51:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdyet7jwc24 2026-08-05 17:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse26vdjur2s 2026-08-05 18:01:06+00:00| seen|...

CVE-2026-60023

creationtimestamp| type| source ---|---|--- 2026-08-05 15:49:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4c2kiitqv5xnt...

CVE-2026-50749

creationtimestamp| type| source ---|---|--- 2026-08-05 15:43:11+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/hhbopx5ltrfbd...

MAL-2026-13248 Malicious code in bigops-rx-post-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1298706de8e41561be6743e6d8349c5feefb81bec1ba71f3f2da3995d845ac98 On require of bigops-rx-post-message, index.js executes init.js at module top level, which downloads a platform-specific binary from Cloudflare Worke...

CVE-2026-48834

creationtimestamp| type| source ---|---|--- 2026-08-05 15:13:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/fcpo4l6tlfssz...

CVE-2026-14869

creationtimestamp| type| source ---|---|--- 2026-08-05 15:00:06+00:00| seen| https://t.me/thehackernews/9717 2026-08-06 00:00:33+00:00| seen| https://t.me/thehackernews/9717 2026-08-29 20:00:06+00:00| seen| https://t.me/CyberDispatch/2484 2026-08-30 00:00:37+00:00| seen|...

CVE-2026-61484

creationtimestamp| type| source ---|---|--- 2026-08-05 14:42:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/a2wgyu63gboz4...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating o...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

CVE-2026-16443

creationtimestamp| type| source ---|---|--- 2026-08-05 14:20:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jb5m44hrlhlib 2026-08-06 13:10:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msg4hotxsw2a 2026-08-26 00:40:05+00:00| seen|...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

CVE-2026-15979

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

MAL-2026-12790 Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...

MAL-2026-12810 Malicious code in the-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-creat...

Malicious code in wolverinechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad1c6bad5ee8d3cb562503b94d5534ba2c98ad5b4854c073e1482d59ab8687e package.json declares a preinstall hook that runs index.js during npm install. The script reads /etc/passwd, /etc/hosts, os.hostname,...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...