CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-13874

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevvwwou2b 2026-07-02 07:21:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:29+00:00| seen|...

CVE-2026-13873

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevc452j2o 2026-07-02 07:21:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:24+00:00| seen|...

CVE-2026-49119

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmeva52lk2i 2026-07-02 10:29:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt6rcytn2m 2026-07-02 10:29:49+00:00| seen|...

CVE-2026-13877

creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmekvu2dg2q 2026-07-02 07:22:02+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:38+00:00| seen|...

CVE-2026-13872

creationtimestamp| type| source ---|---|--- 2026-07-01 20:25:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdyzavs424 2026-07-02 07:21:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-58517

creationtimestamp| type| source ---|---|--- 2026-07-01 20:19:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdoxmgz72v 2026-07-02 10:27:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt26cq262y 2026-07-02 11:56:50+00:00| seen|...

CVE-2026-13888

creationtimestamp| type| source ---|---|--- 2026-07-01 20:17:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdk6z7sk26 2026-07-02 07:22:29+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 18:59:00+00:00| seen|...

CVE-2026-41121

creationtimestamp| type| source ---|---|--- 2026-07-01 20:16:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdjlmofc2b 2026-07-02 10:31:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpntcdocin2m 2026-07-02 11:55:31+00:00| seen|...

CVE-2026-53467

creationtimestamp| type| source ---|---|--- 2026-07-01 20:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdenqcm72b 2026-07-02 09:56:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnrbw7ifn22 2026-07-02 11:55:52+00:00| seen|...

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

CVE-2026-13808

creationtimestamp| type| source ---|---|--- 2026-07-01 19:58:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmcj2exul2b 2026-07-02 01:10:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmtwdsjug2b 2026-07-02 07:19:21+00:00| seen|...

CVE-2026-13820

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmc2yccw72t 2026-07-02 07:19:47+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:47+00:00| seen|...

CVE-2026-13826

creationtimestamp| type| source ---|---|--- 2026-07-01 19:46:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbtkbi3d2y 2026-07-02 07:20:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13825

creationtimestamp| type| source ---|---|--- 2026-07-01 19:46:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbsku4gf2q 2026-07-02 07:19:58+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13817

creationtimestamp| type| source ---|---|--- 2026-07-01 19:31:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmayj5ohn2q 2026-07-02 07:19:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:41+00:00| seen|...

Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

CVE-2026-58520

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from before 1.43.9, 1.44.6, 1.45.4...

GHSA-PVRJ-8CG3-J5F8 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...