112320 matches found
CVE-2026-15067
creationtimestamp| type| source ---|---|--- 2026-07-08 17:30:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nict4ia2k...
Malicious code in configration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3255dd4ea4a24b3e000f6a8aadb9a022bc9aed07507124a595dd42ef0b429d6e The package impersonates the pino logger README badges, module.exports.pino = middleware under a one-character-omission name configration vs...
DEBIAN-CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-59923
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
PYSEC-2026-2211
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-55075
creationtimestamp| type| source ---|---|--- 2026-07-08 17:07:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq5m7qsymz26...
MAL-2026-6999 Malicious code in luludawang-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...
CVE-2026-49145
creationtimestamp| type| source ---|---|--- 2026-07-08 16:30:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5k5n2qyc24...
CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-6740
creationtimestamp| type| source ---|---|--- 2026-07-08 16:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq5jdlqkpu22...
CVE-2026-0288
creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:21+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116885246523577101 2026-07-08 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soxii4n22 2026-07-08 20:15:02+00:00| seen|...
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59923
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59923
CVE-2026-59923 affects Mistune, a Python Markdown parser. Before 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. The issue is fixed in version 3.3.0. E...
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-56776
creationtimestamp| type| source ---|---|--- 2026-07-08 16:09:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5iyjp3my2w...