CVE-2026-33252

A flaw was found in the Go MCP SDK's Streamable HTTP transport, which uses Go's standard encoding/json package. In deployments without authorization, a remote attacker can exploit this Cross-Site Request Forgery CSRF vulnerability. By sending browser-generated cross-site POST requests to a local...

Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm)

Malicious post-install script combined with low project popularity indicates potential malware. Arbitrary code execution is a major concern. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebe31c5bb51c354ed83627a02c11ca4c8541e042623b1b987255941ffafdaff The...

MAL-2026-2410 Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm)

Malicious post-install script combined with low project popularity indicates potential malware. Arbitrary code execution is a major concern. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebe31c5bb51c354ed83627a02c11ca4c8541e042623b1b987255941ffafdaff The...

CVE-2026-27115

creationtimestamp| type| source ---|---|--- 2026-03-24 08:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhs5cw3akh2w...

CVE-2026-33852

creationtimestamp| type| source ---|---|--- 2026-03-24 07:16:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrzrcryj62d 2026-03-24 09:51:37+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhscghmn3m2o 2026-03-24 10:28:12+00:00| seen|...

CVE-2026-33850

creationtimestamp| type| source ---|---|--- 2026-03-24 07:00:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhryto3hvu2l...

CVE-2026-4745

creationtimestamp| type| source ---|---|--- 2026-03-24 06:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhry7uvyye2f 2026-03-24 09:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116283331651758120 2026-03-24 09:00:31+00:00| seen|...

CVE-2026-4731

creationtimestamp| type| source ---|---|--- 2026-03-24 06:40:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrxptxwy62f...

CVE-2026-4640

creationtimestamp| type| source ---|---|--- 2026-03-24 05:25:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrtk7qoca2a 2026-03-24 07:01:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrywm3tqo2g 2026-06-11 00:37:06+00:00| seen|...

CVE-2026-3079

creationtimestamp| type| source ---|---|--- 2026-03-24 04:29:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrqh4lfz22g...

CVE-2026-4623

creationtimestamp| type| source ---|---|--- 2026-03-24 04:24:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrq665z2c2i...

CVE-2026-4738

creationtimestamp| type| source ---|---|--- 2026-03-24 03:17:29+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4738 2026-03-24 07:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrztxgbz72x...

CVE-2026-4680

creationtimestamp| type| source ---|---|--- 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260324 2026-03-24 01:30:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrggqvp2g24 2026-03-24 02:13:12+00:00|...

EUVD-2026-14593

OpenClaw before 2026.3.1 contains an approval bypass vulnerability in system.run where non-path-like argv0 tokens fail to bind executable identity, allowing post-approval executable rebind. Attackers can modify PATH resolution after approval to execute a different binary than the operator approve...

CVE-2026-33282

creationtimestamp| type| source ---|---|--- 2026-03-24 00:19:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrchsct5y2g 2026-03-25 02:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhtykju5ts2c...

CVE-2026-33252

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization,...

CVE-2026-33169

creationtimestamp| type| source ---|---|--- 2026-03-24 00:07:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrbrw6d2n2i 2026-03-24 03:00:04+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mhrlgk7obs2p...

CVE-2026-33173

creationtimestamp| type| source ---|---|--- 2026-03-24 00:03:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrbkig46b2v...

CVE-2026-33176

creationtimestamp| type| source ---|---|--- 2026-03-24 00:01:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrbh4rklw2x...

Unspecified vulnerability in Discourse (CNVD-2026-17481)

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from a security vulnerability due to an overly broad authorization check on the deleted post index endpoint, which can ...