CVE-2026-12273

creationtimestamp| type| source ---|---|--- 2026-07-13 07:41:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6vfbljy2y 2026-07-14 03:38:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlbsllbjm2c...

CVE-2026-4769

creationtimestamp| type| source ---|---|--- 2026-07-13 07:21:18+00:00| seen| https://infosec.exchange/users/certvde/statuses/116911458109125585 2026-07-13 07:54:49+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqj7nsuneh2l 2026-07-13 08:30:05+00:00| seen|...

MAL-2026-10420 Malicious code in path-addon-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b383636076e2701a372675c281ee82463d97529ed7d8db027276aa8a8b68b966 path-addon-extend presents itself as a copy of Node's built-in path module. On module load, path.js issues an HTTPS GET to a base64-obscured URL that...

MAL-2026-10410 Malicious code in cookie-phase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c The package presents itself as the popular pino logger README badges, exported module.exports.pino = middleware but its name and metadata are...

MAL-2026-10411 Malicious code in cookie-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f The package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a...

Vulnerabilities found in Juniper Networks’ Junos OS and Junos OS Evolved

Juniper has identified several vulnerabilities in Junos OS and Junos OS Evolved, specifically related to devices in the MX Series, PTX Series, QFX Series, EX Series, SRX Series, and QFX10000 Series. These vulnerabilities affect various components of Junos OS and Junos OS Evolved, including the...

Server-side Request Forgery (SSRF)

Overview adloop is a The AI command center for Google Ads, GA4, and tracking code. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validateurls function. An attacker can induce the server to make arbitrary HTTP requests by supplying crafted input to th...

Malicious code in chai-as-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...

CVE-2026-49876

creationtimestamp| type| source ---|---|--- 2026-07-13 04:10:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqit4ca7od2c 2026-07-13 18:58:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeqdsbpl2i 2026-07-14 03:54:38+00:00| seen|...

CVE-2026-15525

CVE-2026-15525 affects the kLOsk adloop package up to version 0.9.0. The vulnerability is in the function _validate_urls in src/adloop/ads/write.py, where manipulating the argument final_url can trigger a server-side request forgery (SSRF). The issue can be exploited remotely and the exploit is p...

CVE-2026-15525

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15551

creationtimestamp| type| source ---|---|--- 2026-07-13 01:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik6uqc3l2e 2026-07-13 03:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirjanmxp2z...

MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

CVE-2026-15514

creationtimestamp| type| source ---|---|--- 2026-07-13 00:30:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqigsyplnr2y 2026-07-13 04:08:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiszrfnrl2w...

CVE-2026-15507

creationtimestamp| type| source ---|---|--- 2026-07-13 00:01:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqifa5gev425 2026-07-13 20:46:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkksfgwji2z...

PT-2026-60022

Summary The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the load from url async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. Affected Component - File:...

PT-2026-59336

Summary A Server-Side Request Forgery SSRF vulnerability exists in process picture url in backend/open webui/utils/oauth.py line 1338. The function fetches arbitrary URLs from OAuth picture claims without applying validate url, allowing an attacker to force the server to make HTTP requests to...

PT-2026-59141

While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for this MCP server, the token is issued for the base url passed to...

PT-2026-59016

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function process audio block of the file src/agentscope/agent/ agent base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the...

CVE-2026-41041: Improper Handling of URL Encoding (Hex Encoding)

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...