CVE-2026-55661

CVE-2026-55661 affects TinaCMS rich-text rendering (Slate JSON) where the url field on Slate link/image nodes was not sanitized, allowing stored XSS via dangerous URL schemes such as javascript: or data:text/html. Affected versions include tinacms/mdx <2.1.7 and tinacms =2.1.7 and tinacms >...

CVE-2026-13870

creationtimestamp| type| source ---|---|--- 2026-07-01 20:44:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmf2a2fkj2d 2026-07-02 07:21:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13889

creationtimestamp| type| source ---|---|--- 2026-07-01 20:43:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmeymz4662i 2026-07-02 07:22:31+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13885

creationtimestamp| type| source ---|---|--- 2026-07-01 20:40:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmetsdtxb2d 2026-07-02 07:22:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 18:50:59+00:00| seen|...

CVE-2026-49857

creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:16+00:00| published-proof-of-concept| https://github.com/ymw0407/auth-fetch-mcp/security/advisories/GHSA-pvrj-8cg3-j5f8...

CVE-2026-13884

creationtimestamp| type| source ---|---|--- 2026-07-01 20:09:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmd4ooo6k2q 2026-07-02 07:22:20+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:51+00:00| seen|...

CVE-2026-55577

creationtimestamp| type| source ---|---|--- 2026-07-01 20:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcy6rdbd27 2026-07-02 10:27:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt3c4ngk2r 2026-07-02 11:53:58+00:00| seen|...

CVE-2026-55628

creationtimestamp| type| source ---|---|--- 2026-07-01 20:01:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcnwywan2v 2026-07-02 10:28:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt45sf6m2r...

CVE-2026-13813

creationtimestamp| type| source ---|---|--- 2026-07-01 19:59:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmck23pwb2o 2026-07-01 20:56:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpmfqclbau2p 2026-07-02 01:30:42+00:00| seen|...

CVE-2026-13812

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbzmsevo2t 2026-07-02 01:30:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmv27cvmp2b 2026-07-02 07:19:30+00:00| seen|...

GHSA-M492-GV72-XVXJ Kimai Password Reset Link Remains Valid After Password Change

Summary The LoginLink signature used for password reset URLs covers only the user's id — it does not include the password hash. After a user clicks a reset link and successfully changes their password, the same link remains valid for up to 2 additional uses within a 1-hour window. Anyone who...

CVE-2026-13814

creationtimestamp| type| source ---|---|--- 2026-07-01 19:48:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbwvzc5t2i 2026-07-02 07:19:34+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:35+00:00| seen|...

CVE-2026-13811

creationtimestamp| type| source ---|---|--- 2026-07-01 19:48:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbw2ej462q 2026-07-02 07:19:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 12:26:39+00:00| seen|...

CVE-2026-13807

creationtimestamp| type| source ---|---|--- 2026-07-01 19:47:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbuchs6h26 2026-07-02 07:19:19+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 12:29:40+00:00| seen|...

CVE-2026-41121

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access 'Link Following’ vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-13773

creationtimestamp| type| source ---|---|--- 2026-07-01 18:59:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm76q5gwb2r 2026-07-06 18:55:02+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mpyrbwcy7l2h...

CVE-2025-36336

creationtimestamp| type| source ---|---|--- 2026-07-01 18:57:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm74jljmt2p...

CVE-2026-41121

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access 'Link Following’ vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-41121

Dell Device Management Agent (DDMA) versions before 26.05 are affected by an Improper Link Resolution Before File Access (Link Following) vulnerability. A low-privilege, local attacker could potentially exploit this to achieve Elevation of Privileges. The CVSS3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U...

MAL-2026-6707 Malicious code in svgson-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ceb1026a96918a3f4ed4c7c4f0aa75411c3869f1ad14405174e396b4e67907d2 index.js exports an undocumented getPlugin function which, when invoked, performs an HTTP GET to https://shorturl.at/147uq, JSON-parses the response...