CVE-2026-12382

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-54560

creationtimestamp| type| source ---|---|--- 2026-07-15 16:41:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5yw2ad72s...

CVE-2026-61836

creationtimestamp| type| source ---|---|--- 2026-07-15 16:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqp3r2rc6t2i 2026-07-21 09:13:06+00:00| seen| https://bsky.app/profile/suriq.io/post/3mr5hr26efm2q...

CVE-2025-62826

creationtimestamp| type| source ---|---|--- 2026-07-15 14:20:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...

CVE-2026-59235

creationtimestamp| type| source ---|---|--- 2026-07-15 13:50:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqouh5o35a2a...

CVE-2026-44021

creationtimestamp| type| source ---|---|--- 2026-07-15 10:30:04+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mqojbaj2up2b...

CVE-2026-49459

A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. A remote attacker could exploit a vulnerability in the DOMPurify.sanitize function when used with the INPLACE: true option. This flaw allows an attacker to bypass the...

Exploit for CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB Injection Vulnerab...

CVE-2026-13230

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnswetk7c2a...

CVE-2026-48254

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:15+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswdihda2t...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...

CVE-2026-15751

creationtimestamp| type| source ---|---|--- 2026-07-15 00:20:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnh6iiwsk2l 2026-07-27 09:03:41+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmjztw76g25 2026-07-27 09:03:41+00:00| seen|...

GHSA-MQXV-9RM6-W8QC

creationtimestamp| type| source ---|---|--- 2026-07-14 22:13:10+00:00| seen| https://gist.github.com/alon710/c304e0355d4b523094aabb49f860b83c...

CVE-2026-49459

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...

DEBIAN-CVE-2026-49459

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...

GHSA-Q3V2-XJ35-9GRX

creationtimestamp| type| source ---|---|--- 2026-07-14 20:12:07+00:00| seen| https://gist.github.com/alon710/57f8fdc68fb17b420e33683532c115ad...

CVE-2026-49459 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...

CVE-2026-49459

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizeroot, INPLACE: true could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by isClobbered, because forceRemove...

GHSA-VVP9-H8P2-XWFC

creationtimestamp| type| source ---|---|--- 2026-07-14 19:42:05+00:00| seen| https://gist.github.com/alon710/553eb2089447345d30a93b1881dc2ee5...

CVE-2026-45754

CVE-2026-45754 affects Symfony’s Mailjet mailer bridge and LOX24 notifier bridge. Prior to versions 6.4.40, 7.4.12, and 8.0.12, the webhook parsers did not verify configured webhook secrets, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 events. The issue is fixed in th...