8953 matches found
[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`
ImpactAPIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. ReferencesISSUEPATCH...
MiracleLinux 9 : libsoup-2.72.0-16.el9_8.1 (AXSA:2026-1210:11)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1210:11 advisory. libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment CVE-2026-5119 Tenable has extracted the...
CVE-2025-50492
creationtimestamp| type| source ---|---|--- 2026-07-06 06:08:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxggl6bz52i...
CVE-2025-71343
creationtimestamp| type| source ---|---|--- 2026-07-04 04:16:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mps7arpltr27 2026-07-04 06:14:47+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpsfunjwiy2x 2026-07-04 15:01:15+00:00| seen|...
CVE-2026-57765
creationtimestamp| type| source ---|---|--- 2026-07-02 12:14:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnyzwok7p2w 2026-07-02 13:42:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpo5xsoa2s2m 2026-07-03 00:46:54+00:00| seen|...
CVE-2026-55597
creationtimestamp| type| source ---|---|--- 2026-07-02 11:56:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnxzt4tn52o 2026-07-03 13:27:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnlk6zdd2y...
CVE-2026-14417
creationtimestamp| type| source ---|---|--- 2026-07-02 00:09:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmqj2s5wc2e 2026-07-02 02:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpmwrtq35n2x 2026-07-02 03:00:27+00:00| seen|...
Malicious code in @marketfront/blenderdevtool (npm)
The @marketfront/blenderdevtool package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
Malicious code in @marketfront/errorcounter (npm)
The @marketfront/errorcounter package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
MAL-2026-6774 Malicious code in @marketfront/devtoolsloader (npm)
The @marketfront/devtoolsloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)
The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
Code Injection in Perforce Helix Core (CVE-2026-6902)
Executive Summary In this article, we disclose our latest findings we made on Perforce protocol P4 Helix Core between command line client and server, and reveal how a threat actor could leverage it to conduct attacks. This security issue affects P4 Helix Core before P4 Helix Core 2025.2 Patch 2,...
CVE-2026-13999
creationtimestamp| type| source ---|---|--- 2026-07-01 21:17:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgwfxuab26 2026-07-02 07:48:50+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:21:14+00:00| seen|...
MAL-2026-6713 Malicious code in polymarket-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa9243f492d222e1bb036c8ed55fb17268bd987a63ad2ea2aa1b28e44defc3 Package is published as a Polymarket API client but its default export getPlugin performs unconditional remote code execution on use. On invocation i...
CVE-2026-13798
creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116842990988360734 2026-07-02 07:18:59+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:10+00:00| seen|...
CVE-2026-10763
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server...
CVE-2026-10763: Undefined Security Weakness
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server...
SUSE SLES15 Security Update : bind (SUSE-SU-2026:2676-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2676-1 advisory. This update for bind fixes the following issues - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation...