CVE-2026-18614

creationtimestamp| type| source ---|---|--- 2026-08-03 18:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms76bze77b2h 2026-08-03 20:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7bzldpxe2e 2026-08-03 20:44:32+00:00| seen|...

CVE-2026-51785

creationtimestamp| type| source ---|---|--- 2026-08-03 18:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms766fxfxh2m...

GHSA-FXQJ-RQCC-2CMP

creationtimestamp| type| source ---|---|--- 2026-08-03 18:31:17+00:00| seen| https://gist.github.com/alon710/cea21195fa5b2fd7a130b5ccd15ff053...

CVE-2026-40717

creationtimestamp| type| source ---|---|--- 2026-08-03 18:27:32+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117032986315511601...

CVE-2026-69153

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-67611

creationtimestamp| type| source ---|---|--- 2026-08-03 18:02:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h4e6aocoakogt...

CVE-2026-12965

creationtimestamp| type| source ---|---|--- 2026-08-03 17:54:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72wozp2t2o...

CVE-2026-16532

creationtimestamp| type| source ---|---|--- 2026-08-03 17:52:18+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72t4dfzy23...

CVE-2025-69948

creationtimestamp| type| source ---|---|--- 2026-08-03 17:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72plzxnp2a...

CVE-2025-69946

creationtimestamp| type| source ---|---|--- 2026-08-03 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72pkjtn22z...

CVE-2026-69152

creationtimestamp| type| source ---|---|--- 2026-08-03 17:31:36+00:00| seen| https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec 2026-08-03 18:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg 2026-08-04 12:00:52+00:00| seen|...

CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

UBUNTU-CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...

Directory Traversal

Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is skipped when the...

GHSA-FXQJ-RQCC-2CMP PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...

NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...

Directory Traversal

Overview org.webjars.npm:postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is...

CVE-2019-1749

creationtimestamp| type| source ---|---|--- 2026-08-03 17:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96464 2026-08-04 00:00:32+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96464...

EUVD-2026-52373

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...