CVE-2026-50017

creationtimestamp| type| source ---|---|--- 2026-06-25 17:52:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4yn7uldp2j...

CVE-2018-12972

creationtimestamp| type| source ---|---|--- 2026-06-25 17:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp4xsgtipk2h...

Security Bulletin: SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection

Summary Langflow OSS versions = 1.9.3 contain SSRF vulnerability in legacy RSS Reader and SearXNG components that bypass SSRF protection introduced in v1.9.3. RSSReaderComponent calls requests.getself.rssurl directly on user input without validateurlforssrf check, completely bypassing protection...

CVE-2026-55412

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only...

CVE-2026-55411

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-9183

creationtimestamp| type| source ---|---|--- 2026-06-25 17:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4wmvxbmf2f...

CVE-2026-56445

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:36+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-01 2026-06-25 21:15:02+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-01 2026-06-25 22:05:41+00:00| seen|...

CVE-2026-56414

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:34+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-05 2026-06-27 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpacpui4i32p 2026-06-27 01:30:36+00:00| seen|...

CVE-2026-9718

creationtimestamp| type| source ---|---|--- 2026-06-25 17:15:29+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-07...

CVE-2026-27366

creationtimestamp| type| source ---|---|--- 2026-06-25 17:14:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mp4wjhseyg2h...

CVE-2026-54821

creationtimestamp| type| source ---|---|--- 2026-06-25 17:07:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp4w67bmw227 2026-06-30 00:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphpxmac5a25...

MAL-2026-6466 Malicious code in gx-npm-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fcad1b944d9ceb92389673398df9f471911a788fe608774a3298c69900bb1c7 [email protected] is a dependency-confusion squat max-semver 99.99.99 on a gx--prefixed name to outrank a private internal package that...

CVE-2026-55487

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator...

CVE-2026-55487 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator...

CVE-2026-55487

CVE-2026-55487 affects pnpm. Prior to versions 10.34.2 and 11.5.3, the generic peer-suffix normalizer could strip parenthesized text from git, URL, tarball, file, and other opaque locators, allowing approval for one source string to authorize an attacker-controlled source whose locator normalizes...

CVE-2026-55487 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator...

CVE-2026-48942

K2 ≤ 2.26 renders the k2users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping...

UBUNTU-CVE-2026-57451

Vim is an open source, command line text editor. Prior to 9.2.0670, gettextprops in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textpropT entries that follow. The only check is a floor that guarantees room for a single...

CVE-2026-55411

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in th...

CVE-2026-55411

ToolJet prior to 3.20.1780-lts exposes a cross-tenant confidentiality flaw: authenticated users can decrypt any organization’s data-source secret via POST /api/data-sources/decrypt by supplying a credential_id, because the handler bypasses ValidateDataSourceGuard and ignores organization scoping ...