CVE-2026-49091

creationtimestamp| type| source ---|---|--- 2026-07-01 21:16:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmgukqswx2n 2026-07-02 09:25:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnpmdrswj27 2026-07-02 13:50:27+00:00| seen|...

CVE-2026-14013

creationtimestamp| type| source ---|---|--- 2026-07-01 21:15:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgrvqvtc2u 2026-07-02 07:49:20+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:21:55+00:00| seen|...

CVE-2026-54263

Wagtail (Django-based CMS) has a reflected XSS in the dynamic image URL generator view within the admin. A limited-permission editor could craft a URL that, when seen by a higher-privilege user, could act with that user’s credentials. Affected versions: < 7.0.8, < 7.3.3,

CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for...

CVE-2026-54263

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for...

CVE-2026-54263

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for...

CVE-2026-13941

creationtimestamp| type| source ---|---|--- 2026-07-01 21:10:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgj5wwed2i 2026-07-02 07:46:42+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:19:26+00:00| seen|...

CVE-2026-13936

creationtimestamp| type| source ---|---|--- 2026-07-01 21:09:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmghgqlnq2d 2026-07-02 07:46:31+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13946

creationtimestamp| type| source ---|---|--- 2026-07-01 21:08:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgfdoyw52o 2026-07-02 07:46:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 11:40:19+00:00| seen|...

CVE-2026-55660 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-55660 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

EUVD-2026-41143

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-55660

CVE-2026-55660 : TinaCMS and Tinacms app prior to versions 2.5.6 / 3.9.3 allow cross-origin postMessage abuse due to window message listeners that do not validate event.origin/source and post to non-specific origins, combined with insufficient URL sanitization in rich-text content. This enables s...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-14209

creationtimestamp| type| source ---|---|--- 2026-07-01 20:59:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpmfved2rg2n 2026-07-02 12:24:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnzmqi6co2w...

MAL-2026-6715 Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

MAL-2026-6716 Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...