75233 matches found
EUVD-2026-54261
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
CVE-2026-71478
Summary. league/commonmark 1.5.0–2.8.3 is vulnerable due to the AttributesExtension href/src unsafe-link filter bypass when control bytes are embedded in a javascript: URL. The browser may execute the script after the URL is parsed, even with allow_unsafe_links enabled. The issue is caused by ins...
CVE-2026-45378
CVE-2026-45378 affects Decidim where the identity-document verification admin UI embeds verification_attachment blobs using reusable signed Active Storage disk URLs. The implementation renders images with variant_url(...), producing signed /rails/active_storage/disk/... links that bypass authoriz...
CVE-2026-15235
creationtimestamp| type| source ---|---|--- 2026-08-06 19:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgqufchaa2n...
GHSA-CXJQ-MRR5-89RV
creationtimestamp| type| source ---|---|--- 2026-08-06 18:31:30+00:00| seen| https://gist.github.com/alon710/1c8a7f596af5fdd35dfa04b0effb7a0b...
CVE-2026-18322
creationtimestamp| type| source ---|---|--- 2026-08-06 18:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgnj44m7r2n 2026-09-24 21:11:58+00:00| seen| https://bsky.app/profile/packetstorm.bsky.social/post/3mwc6ah37yn2y 2026-10-03 03:56:15+00:00| seen|...
WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by luc in WordPress Plugin Simple Link Directory Pro versions = 15.0.8...
Malicious Package
Overview streak-cache-map is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
GHSA-X677-9FXG-V5C5
creationtimestamp| type| source ---|---|--- 2026-08-06 17:31:27+00:00| seen| https://gist.github.com/alon710/b0c30693be99e5683b1b7fa34bf1c9d1...
CVE-2026-53977
creationtimestamp| type| source ---|---|--- 2026-08-06 17:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgjdzwjiu2z...
CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...
CVE-2026-18487
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...
CVE-2021-32036
creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:22+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01...
CVE-2026-65578
creationtimestamp| type| source ---|---|--- 2026-08-06 16:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggqohynx22...
CVE-2026-65552
creationtimestamp| type| source ---|---|--- 2026-08-06 16:08:29+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggfvrb242u 2026-08-12 02:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msu2pt7kv42u...
CVE-2026-65548
creationtimestamp| type| source ---|---|--- 2026-08-06 16:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggcelol42b...
CVE-2026-65571
creationtimestamp| type| source ---|---|--- 2026-08-06 15:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgftzmnlr2l...
CVE-2026-53983
The CVE concerns Ground Station prior to 0.6.0, exposing an unauthenticated blind SSRF via the orbital-source URL path. An unauthenticated Socket.IO client can connect on port 7000 (credentials not required, wildcard CORS) and submit a data_submission with submit-orbital-sources to store an attac...
CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...