CVE-2026-49822 Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger KWT in their own namespace was able to establish a persistent...

CVE-2026-42599

A flaw was found in Svelte. When an application uses spread syntax to render attributes from untrusted data, event handler properties are included in the generated HTML output. This allows a remote attacker to inject malicious event handlers that can execute in a victim's web browser, leading to...

CVE-2025-71330

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to...

CVE-2025-71329 image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...

CVE-2025-71330 image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to...

CVE-2025-71330 image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to...

CVE-2025-71330

The CVE-2025-71330 issue affects image-size

Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar

Your pentest report looks clean. That might be the problem. Run automated pentesting long enough, and the new findings start to dry up. By the third or fourth run, fewer issues appear. The report looks stable. Leadership reads "stable" as "secure." It usually isn't. The work slows down. The risk...

CVE-2026-47906

creationtimestamp| type| source ---|---|--- 2026-06-10 09:06:07+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnweavss3g27 2026-06-12 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo2h2xtdbn2o...

CVE-2025-62851

creationtimestamp| type| source ---|---|--- 2026-06-10 05:49:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnvzblb5bo2v 2026-06-17 12:00:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moibaup52w2j 2026-06-18 03:38:08+00:00| seen|...

Dana Powers kafka-python 资源管理错误漏洞

Kafka-Python is a distributed stream processing engine client library written entirely in Python by Dana Powers. Versions of Kafka-Python prior to 2.3.2 contained a resource management vulnerability. This vulnerability stemmed from the lack of verification of the iteration count during SCRAM...

PT-2026-48556

Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser...

PT-2026-48404

Name of the Vulnerable Software and Affected Versions image-size versions prior to 2.0.3 Description A denial of service issue exists where remote attackers can permanently block the Node.js event loop by providing a specially crafted ICNS image buffer. By supplying an ICNS buffer with valid magi...

openSUSE 15: azure-cli / azure-cli-core / azure-cli-telemetry / python311-anyio / etc (SUSE-SU-SUSE-RU-2026:2237-2)

"The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2026:2237-2 advisory. Changes in azure-cli-core: - Drop CVE-2025-24049 patch, fixed upstream - New upstream release - Version 2.82.0 - For detailed information...

PT-2026-48531

Name of the Vulnerable Software and Affected Versions kafka-python versions prior to 2.3.2 Description A denial-of-service issue exists in the SCRAM authentication handling. A malicious or machine-in-the-middle broker can freeze the client event loop by providing an excessively large iteration...

PT-2026-48477

Name of the Vulnerable Software and Affected Versions @hulumi/baseline versions prior to 1.4.0 Description Issues in the AccountFoundation component allow the S3 bucket used for CloudTrail and AWS Config audit logs to be modified or deleted, compromising the forensic trail. This occurs through...

GHSA-833P-95JQ-929Q

creationtimestamp| type| source ---|---|--- 2026-06-09 23:11:25+00:00| seen| https://gist.github.com/alon710/c5822daca832e3ff7c46650aefcc77c9...

CVE-2026-34711

creationtimestamp| type| source ---|---|--- 2026-06-09 23:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvcflawlb2n 2026-06-10 02:03:22+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnvmmyg4nr2a...

CVE-2026-36934

creationtimestamp| type| source ---|---|--- 2026-06-09 22:15:53+00:00| seen| https://gist.github.com/OxBat/67c10534910e1409e04ae923c38fca2b...

CVE-2026-34416 OSCAL-GUI Reflected XSS via project parameter in oscal.php

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that...