112257 matches found
CVE-2026-15583
Grafana MCP Server is affected by CVE-2026-15583, a confusion-deputy vulnerability that allows an unauthenticated remote attacker to exfiltrate the server’s Grafana service-account token and perform SSRF via a crafted X-Grafana-URL header. The flaw enables targeting internal services, including c...
CVE-2026-35152
creationtimestamp| type| source ---|---|--- 2026-07-15 06:55:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5cffab52h 2026-07-15 13:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoseeru4y2c 2026-07-16 10:37:06+00:00| seen|...
SUSE CVE-2026-59083
Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...
CVE-2026-8920
creationtimestamp| type| source ---|---|--- 2026-07-15 04:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnukuc5ul22 2026-07-15 16:45:06+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:09:32+00:00| seen|...
CVE-2026-15029
creationtimestamp| type| source ---|---|--- 2026-07-15 04:09:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntywrdti2u 2026-07-15 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:40:21+00:00| seen|...
Malicious code in core-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....
MAL-2026-10631 Malicious code in core-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....
CVE-2026-15030
creationtimestamp| type| source ---|---|--- 2026-07-15 03:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnt62ow2c22 2026-07-27 21:25:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrnthhrsve2a 2026-07-27 21:39:56+00:00| seen|...
MAL-2026-10630 Malicious code in chai-as-byte (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...
EUVD-2026-44515
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcpgetComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack ma...
CVE-2026-15752
creationtimestamp| type| source ---|---|--- 2026-07-15 00:09:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqngmfzazt24 2026-07-27 08:46:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmj3u7hwj23 2026-07-27 08:47:41+00:00| seen|...
CVE-2026-5270
creationtimestamp| type| source ---|---|--- 2026-07-15 00:04:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqngczzwyz2x 2026-07-15 13:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqotriltvq2p 2026-07-27 09:08:14+00:00| seen|...
PT-2026-60384
Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can trigger server-side requests to internal destinations, such as loopback, Docker bridge, or RFC1918 HTTP addresses, because the Subsonic-compatible createPodcastChannel.view...
PT-2026-58884
Name of the Vulnerable Software and Affected Versions Grafana MCP Server affected versions not specified Description A confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the environment-configured Grafana service-account token. This is achieved by supplying a crafted...
RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) (RHSA-2026:39810)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39810 advisory. Security Fixes: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 golang: Denial of Service due to excessive...
CVE-2026-36035
creationtimestamp| type| source ---|---|--- 2026-07-14 23:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfqvwm4q27 2026-07-27 09:05:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk5mowaa27...
CVE-2026-48337
creationtimestamp| type| source ---|---|--- 2026-07-14 23:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncs7pxyz2c...
CVE-2026-15774
creationtimestamp| type| source ---|---|--- 2026-07-14 22:59:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqncoq3d3f2g 2026-07-15 23:42:46+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926641968349809 2026-07-16 04:45:29+00:00| seen|...
CVE-2026-48287
CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must...
CVE-2026-15750
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcpgetComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack ma...