112026 matches found
CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69149
creationtimestamp| type| source ---|---|--- 2026-08-03 16:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhtypny2p 2026-08-03 18:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5nwaq22vg5q3w 2026-08-05 02:26:04+00:00| seen|...
html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content
A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...
CVE-2026-67608
creationtimestamp| type| source ---|---|--- 2026-08-03 14:22:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jmbxd5vat537y...
CVE-2025-15675
creationtimestamp| type| source ---|---|--- 2026-08-03 14:22:13+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3ms6p3utr552u...
CVE-2026-69089
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...
CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...
CVE-2026-58062
creationtimestamp| type| source ---|---|--- 2026-08-03 12:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6jtjhgyp2l 2026-08-03 20:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7f7p43zj2p 2026-08-04 09:28:18+00:00| seen|...
CVE-2026-69078
CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...
CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...
CVE-2026-43373
creationtimestamp| type| source ---|---|--- 2026-08-03 07:03:30+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...
CVE-2026-18588
creationtimestamp| type| source ---|---|--- 2026-08-03 06:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5v2eavwb2m...
CVE-2025-71401
creationtimestamp| type| source ---|---|--- 2026-08-03 04:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5os36ck22s 2026-08-04 11:24:49+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msavnlqgs323...
CVE-2026-3245
creationtimestamp| type| source ---|---|--- 2026-08-03 03:42:59+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms5lerlfuh2p...
VulnCheck KEV: CVE-2026-54066
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-67356
creationtimestamp| type| source ---|---|--- 2026-08-02 16:12:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4es7oylx2x...
CVE-2026-9856
creationtimestamp| type| source ---|---|--- 2026-08-02 15:59:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5g6qpc6sfh4ae...
CVE-2026-65321
creationtimestamp| type| source ---|---|--- 2026-08-02 15:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms4cjulwnx2z 2026-08-02 16:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3j3v5ifejd7bh 2026-08-02 16:09:38+00:00| seen|...