CVE-2026-54919

creationtimestamp| type| source ---|---|--- 2026-07-10 22:56:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdamz6jm42x...

MAL-2026-10180 Malicious code in auth-next-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0926f0a2c1f47072efaac014be38bb00c8e9f31f59badf188b1ed74dd5c2ce On require of auth-next-gen, index.js loads lib/writer.js, which at module top level performs an axios GET against a base64-obfuscated URL...

CVE-2026-15373

creationtimestamp| type| source ---|---|--- 2026-07-10 22:21:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6penuac2e 2026-07-11 00:12:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdevow4gb2i 2026-07-11 00:45:40+00:00| seen|...

CVE-2024-52053

creationtimestamp| type| source ---|---|--- 2026-07-10 22:07:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqd5v34qjr25...

UBUNTU-CVE-2026-57211

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

CVE-2026-61461

creationtimestamp| type| source ---|---|--- 2026-07-10 21:01:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqd27bttqh24 2026-07-11 01:11:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdi752b5h2e 2026-07-11 01:11:44+00:00| seen|...

CVE-2026-55665

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-57575 Misskey: SSRF bypass in URL Preview

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

CVE-2026-57575

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

EUVD-2026-43033

OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the...

CVE-2026-55476

creationtimestamp| type| source ---|---|--- 2026-07-10 20:31:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcyku5uto2g 2026-07-11 01:07:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhxajxvf2f...

CVE-2026-58661

creationtimestamp| type| source ---|---|--- 2026-07-10 20:21:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxy5ayys2x 2026-07-13 23:47:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkuvklvvh2c 2026-07-16 08:13:00+00:00| seen|...

CVE-2026-59793

creationtimestamp| type| source ---|---|--- 2026-07-10 20:17:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxrw55ea2i 2026-07-11 00:33:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg2wgqn22i 2026-07-11 04:37:07+00:00| seen|...

CVE-2026-55461

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...

CVE-2026-57211

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

CVE-2026-55461

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

EUVD-2026-39122

SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894...

CVE-2026-15146

GNU Wget versions 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address...