PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69153

CVE-2026-69153 (PostCSS) affects PostCSS prior to 8.5.19. If the option from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL, exposing the map’s sources and sourcesContent. The issue is f...

CVE-2026-69149

creationtimestamp| type| source ---|---|--- 2026-08-03 16:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhtypny2p 2026-08-03 18:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5nwaq22vg5q3w 2026-08-05 02:26:04+00:00| seen|...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

CVE-2026-67608

creationtimestamp| type| source ---|---|--- 2026-08-03 14:22:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jmbxd5vat537y...

CVE-2025-15675

creationtimestamp| type| source ---|---|--- 2026-08-03 14:22:13+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3ms6p3utr552u...

CVE-2026-69089

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

CVE-2026-58062

creationtimestamp| type| source ---|---|--- 2026-08-03 12:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6jtjhgyp2l 2026-08-03 20:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7f7p43zj2p 2026-08-04 09:28:18+00:00| seen|...

CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078

CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...

CVE-2026-43373

creationtimestamp| type| source ---|---|--- 2026-08-03 07:03:30+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...

CVE-2026-18588

creationtimestamp| type| source ---|---|--- 2026-08-03 06:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5v2eavwb2m...

CVE-2025-71401

creationtimestamp| type| source ---|---|--- 2026-08-03 04:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5os36ck22s 2026-08-04 11:24:49+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msavnlqgs323...

CVE-2026-3245

creationtimestamp| type| source ---|---|--- 2026-08-03 03:42:59+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms5lerlfuh2p...

Exploit for CVE-2026-2020

--- CVE-2026-2020 – SSRF via URL Parser Differential...

Exploit for Stack-based Buffer Overflow in Google Chrome

--- CVE-2026-4444 – JWT Algorithm Confusion via kid Injectio...

VulnCheck KEV: CVE-2026-54066

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...