Mage AI 代码注入漏洞

Mage AI is an intelligent program developed by Mage OpenSource, used for building, running, and managing data pipelines. Versions of Mage AI 0.9.79 and earlier contained a code injection vulnerability. This vulnerability stemmed from the use of the query.redirecturl parameter in the useMutation...

PT-2026-47158

Name of the Vulnerable Software and Affected Versions Mage AI versions prior to 0.9.80 Description A cross-site scripting issue exists in the Sign-in Flow component within the useMutation function of the file mage ai/frontend/components/Sessions/SignForm/index.tsx. Manipulation of the...

RHEL 10 : osbuild-composer (RHSA-2026:22450)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22450 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

CVE-2026-11431

creationtimestamp| type| source ---|---|--- 2026-06-05 23:40:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlcsdqg4p2s...

CVE-2026-11424

creationtimestamp| type| source ---|---|--- 2026-06-05 23:35:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlcjfbp5z27...

CVE-2026-11422

creationtimestamp| type| source ---|---|--- 2026-06-05 23:20:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlbojk7yw22...

CVE-2023-39312

creationtimestamp| type| source ---|---|--- 2026-06-05 23:00:34+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnlakgrfx522...

EUVD-2026-31861

Bugsink: Issue event views can show an event from another project if its UUID is known...

CVE-2026-46401

creationtimestamp| type| source ---|---|--- 2026-06-05 21:03:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzzec5z52k...

CVE-2026-11414

creationtimestamp| type| source ---|---|--- 2026-06-05 21:00:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkztxyif42t 2026-06-06 10:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116702696330101939 2026-06-06 10:30:29+00:00| seen|...

CVE-2026-11419

creationtimestamp| type| source ---|---|--- 2026-06-05 20:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkzcm7lbt24 2026-06-06 04:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnlsyefnvw23 2026-06-06 04:30:42+00:00| seen|...

CVE-2026-25621

creationtimestamp| type| source ---|---|--- 2026-06-05 20:47:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkz3nk4lf2l...

CVE-2026-25622

creationtimestamp| type| source ---|---|--- 2026-06-05 20:41:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkysnfjio2u...

CVE-2025-62319

creationtimestamp| type| source ---|---|--- 2026-06-05 20:37:37+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mnkyjvtcie22 2026-08-22 01:38:04+00:00| seen| https://bsky.app/profile/secqube.com/post/3mtn5axxvck23...

Malicious Package

Overview cookie-parser-legacy is a malicious package. This package contains malicious code that uses another malicious package moustick Snyk Advisory as a dependency to fetch a remote payload from attacker-controlled URL https://www.jsonkeeper.com/b/MYUKZ. The payload is designed to extract...

CVE-2026-45748

creationtimestamp| type| source ---|---|--- 2026-06-05 19:51:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnkvyhgz6d2h 2026-06-05 21:01:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkzv7od4t25 2026-06-08 16:37:06+00:00| seen|...

CVE-2026-7150

A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generatefaviconfromurl of the file src/autofavicon/server.py of the component MCP Tool. The manipulation of the argument imageurl results in server-side request forgery...

CVE-2026-7085

A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1. This vulnerability affects the function z.url of the file src/routes/setting/about/downloadApp.ts of the component downloadApp Endpoint. This manipulation of the argument url causes path traversal. It is possible to initiate the...

CVE-2026-34476

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...

CVE-2026-34685

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier NEEDS REVIEW: impact mismatch — ticket says 'Arbitrary file system write', CIA triad derives 'Security Feature Bypass'. Verify CVSS vector before publishing. are affected by an Improper Input...