CVE-2026-67173

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

CVE-2026-51302

creationtimestamp| type| source ---|---|--- 2026-07-28 14:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrplmo2ldr2r 2026-07-29 01:00:03+00:00| seen| https://t.me/GithubRedTeam/95603 2026-07-29 04:00:05+00:00| seen| Telegram/icfrk9NJ0r9US8j4ZgZwjdU3nJ-xiydIySZk2Z3ro5QcgA...

CVE-2026-65893

creationtimestamp| type| source ---|---|--- 2026-07-28 14:00:06+00:00| seen| https://t.me/GithubRedTeam/95522 2026-07-28 21:00:05+00:00| seen| https://t.me/GithubRedTeam/95588 2026-07-29 00:00:08+00:00| seen| Telegram/Q1yPTM1HokNzfLpkFc6iUNC00bXozy1Qi57vCkUVkSVfE8 2026-07-29 00:00:12+00:00| seen|...

CVE-2026-67173 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

CVE-2018-12913

creationtimestamp| type| source ---|---|--- 2026-07-28 13:00:04+00:00| seen| https://t.me/AssasinsOfficial/231 2026-07-29 00:00:35+00:00| published-proof-of-concept| https://t.me/AssasinsOfficial/231 2026-09-02 01:00:04+00:00| seen| https://t.me/backupzxr/167 2026-09-03 00:00:59+00:00|...

Malicious Package

Overview @wagnibot/bsc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @wagnibot/opensea is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-64225

A flaw was found in the Linux kernel's octeontx2-af: CGX component. This vulnerability arises from an out-of-bounds array access. Specifically, the RESPLINKSTATSPEED function can produce an index value that exceeds the allocated size of the cgxspeedmbps array, leading to memory corruption. This...

CVE-2026-65880

creationtimestamp| type| source ---|---|--- 2026-07-28 12:27:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpfvx6jg224...

CVE-2026-15267

creationtimestamp| type| source ---|---|--- 2026-07-28 12:11:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpezcbinh2i...

CVE-2026-8167

creationtimestamp| type| source ---|---|--- 2026-07-28 11:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpdyyeigg2s...

CVE-2026-9680

creationtimestamp| type| source ---|---|--- 2026-07-28 11:35:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpcypa3cy2a...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

D-Link DCS - Unauth Credential Disclosure Detection (CVE-2020-25078)

Detects CVE-2020-25078 by requesting /config/getuser?index=0 and looking for name=/pass= credential lines without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS IP camera credential disclosure via /config/getuser CVE-2020-25078.""" import re from kittysploit import from...

D-Link DIR-3040 1.13B03 - Information Disclosure Detection

D-Link DIR-3040 1.13B03 is susceptible to information disclosure in the Syslog functionality. A specially crafted HTTP network request can lead to the disclosure of sensitive information. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute...

Mailcow < 2026-03b - Href Link Injection Detection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. !/usr/bin/env python3 -- coding: utf-8 -- """mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the...

Froxlor Server Management - Cross-Site Scripting Detection

Froxlor Server Management is susceptible to cross-site scripting via clicking the forgot password link. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

D-Link DIR-600M - Authentication Bypass Detection

D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-600M...

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response Talos IR engagements - an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses,...

CVE-2026-16462

creationtimestamp| type| source ---|---|--- 2026-07-28 09:29:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mrp3vuzo4l42 2026-07-28 11:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpdnn7ydg23 2026-07-28 15:26:06+00:00| seen|...