CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623

PostCSS vulnerability CVE-2026-45623 affects versions up to 8.5.11. The PreviousMap parses the /*# sourceMappingURL=PATH */ comment from CSS, dereferencing PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker-controlled CSS input can cause the host process...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-66390

creationtimestamp| type| source ---|---|--- 2026-07-27 16:48:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrndzrqhm622...

CVE-2026-66390

The Apache Wicket Java web application framework is vulnerable to Cross-site Scripting (XSS) due to improper input neutralization during web page generation. Specifically, the wicket-core component fails to properly escape JavaScript when generating code for Link, ExternalLink, and PopupSettings....

CVE-2026-59550

creationtimestamp| type| source ---|---|--- 2026-07-27 16:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbxujvm524 2026-08-12 14:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msvcxdahlj2i 2026-09-18 04:00:13+00:00| seen|...

CVE-2026-59527

creationtimestamp| type| source ---|---|--- 2026-07-27 16:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbqqrma52q 2026-08-11 13:16:13+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mssp53f5fd26...

CVE-2026-59549

creationtimestamp| type| source ---|---|--- 2026-07-27 16:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbqpcu7s22 2026-08-12 19:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msvtppnvsb2g...

GO-2026-6084 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Gitea: SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL in gitea.dev...

GO-2026-6060 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea...

CVE-2026-65766

creationtimestamp| type| source ---|---|--- 2026-07-27 15:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn66d2p442y...

CVE-2026-47086

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by minting a URLAUTH token through the GENURLAUTH command. This allows bypassing Access Control Lists ACLs, which are rules that control access to mailboxes. Consequently, an attacker could read mail from any...

CVE-2026-57152

creationtimestamp| type| source ---|---|--- 2026-07-27 12:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x...

CVE-2026-47678

creationtimestamp| type| source ---|---|--- 2026-07-27 12:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x...

CVE-2026-53610

creationtimestamp| type| source ---|---|--- 2026-07-27 12:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x 2026-09-26 15:20:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mwglizhfhi2i...

CVE-2026-52848

creationtimestamp| type| source ---|---|--- 2026-07-27 12:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x...

GHSA-6PQ5-P7FC-7XHQ

creationtimestamp| type| source ---|---|--- 2026-07-27 11:51:46+00:00| seen| https://gist.github.com/Correctover/e98078382935c28832271fc5a8e21606...

CVE-2026-17534

Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...

EUVD-2026-49134

Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...