CVE-2026-47410

creationtimestamp| type| source ---|---|--- 2026-07-21 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6djsm3uo2q 2026-07-21 19:10:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6j63qcax23...

Malicious code in url-validatorindx (PyPI)

--- Credit: OpenSSF source...

Malicious code in szn-url (PyPI)

Source: kam193 8dbd5099f883c22c11b6c3e27f199e23751f72efa73b3aac476a63ab17dda5dd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in requesttss (PyPI)

Source: kam193 12a8bc9313963cfa671547d93bfa32236afe6b7dfeeec048633a547aa05dbc12 Clone of the requests package that modified the code to send all get and post requests to a hardcoded URL --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-01-rqsts...

Malicious code in logax (PyPI)

Source: kam193 e129e6d6d38e21a039bd2190e3138f1381ad386e45a49521621a8b8ad61f7678 The package is capable of installing malware from a hardcoded URL. The malware is well-recognized and acts as infostealer. Interestingly, it uses Steam profiles to get the current C2 domain based on sandbox analysis...

Malicious code in axonify (PyPI)

Source: kam193 22991c04631c7553b040a72573bc7d0ad80886ab6bc834ac43f1e1611f85ea02 The package is capable of installing malware from a hardcoded URL. The malware is well-recognized and acts as infostealer. Interestingly, it uses Steam profiles to get the current C2 domain based on sandbox analysis...

CVE-2026-44227

A flaw was found in RT, an issue and ticket tracking system. This reflected Cross-Site Scripting XSS vulnerability allows a remote attacker to execute arbitrary JavaScript code in an authenticated user's browser session. This can happen if an attacker convinces an authenticated user to visit a...

CVE-2026-64824

creationtimestamp| type| source ---|---|--- 2026-07-21 16:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6atxxzj32y 2026-08-10 14:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97436 2026-08-11 00:00:07+00:00| published-proof-of-concept|...

CVE-2026-16447

creationtimestamp| type| source ---|---|--- 2026-07-21 16:37:59+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr6amohkrb2g...

CVE-2026-28306

creationtimestamp| type| source ---|---|--- 2026-07-21 16:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6a6ldxen24 2026-07-26 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrl4xkp7un23...

CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...

CVE-2026-47395

CVE-2026-47395 – PraisonAI CLI loopback/SSRF via @url: mentions Prior to PraisonAI v4.6.40 (and praisonaiagents v1.6.40), the direct-prompt CLI automatically expands @url:(http|https) prompts, performing an unrestricted urllib.request.urlopen() to the attacker-controlled URL. The fetched response...

CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...

CVE-2026-65048

creationtimestamp| type| source ---|---|--- 2026-07-21 15:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr65bleqo52e 2026-07-23 01:01:27+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrbn7txhu52l 2026-07-23 02:02:33+00:00| seen|...

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...

CVE-2026-57496

The "netlicensinggetproduct" MCP tool in "netlicensing-mcp" interpolates a caller-controlled "productnumber" argument directly into a REST URL path without any validation. Passing "../token" as the product number causes "httpx" to normalize "/product/../token" into "/token", silently redirecting...

CVE-2026-59846

creationtimestamp| type| source ---|---|--- 2026-07-21 14:35:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5zrvgfjv2q...

CVE-2026-16402

creationtimestamp| type| source ---|---|--- 2026-07-21 13:57:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5xnw5tvw23 2026-07-22 04:47:38+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 18:42:04+00:00| seen|...

CVE-2026-64628

creationtimestamp| type| source ---|---|--- 2026-07-21 13:18:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vhspcma2g...

SUSE CVE-2026-63896

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...