CVE-2026-48758

creationtimestamp| type| source ---|---|--- 2026-07-15 12:00:51+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mqoodma5yp2c 2026-07-27 03:18:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlwq6g4by2n...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

CVE-2026-15690

creationtimestamp| type| source ---|---|--- 2026-07-15 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mqon5ostp52g 2026-07-21 08:49:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5ggyp73z27 2026-07-21 08:49:52+00:00| seen|...

CVE-2026-61451

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

EUVD-2026-44648

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

CVE-2026-56398

Open WebUI before 0.9.5 is vulnerable to stored XSS via the OAuth picture claim SVG data URI. The code infers MIME type from the URL extension (e.g., .svg) and ignores the server-provided Content-Type, then stores data URI labelling it as image/svg+xml. The profile image validator is bypassed in ...

CVE-2026-47992

creationtimestamp| type| source ---|---|--- 2026-07-15 10:18:35+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqoimquynu2z...

CVE-2026-53486

A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due t...

CVE-2026-11579

creationtimestamp| type| source ---|---|--- 2026-07-15 08:28:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoci4zafs2x...

CVE-2026-12512

creationtimestamp| type| source ---|---|--- 2026-07-15 08:18:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqobw65kbh2w 2026-07-15 12:00:10+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoocffj5p2e 2026-07-15 12:44:11+00:00| seen|...

CVE-2026-56287

creationtimestamp| type| source ---|---|--- 2026-07-15 07:00:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5leeaqi26 2026-07-15 13:05:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqorxo3uto2h 2026-07-21 00:07:06+00:00| seen|...

CVE-2026-42936

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer...

CVE-2026-42936

The CVE-2026-42936 entry concerns the HYPER SBI 2 installer, which insecurely loads Dynamic Link Libraries. A local attacker can place a crafted DLL in the installer’s directory, enabling arbitrary code execution with the invoking user’s privileges during installation. The documented impact is hi...

Installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries

Overview The installer of HYPER SBI 2 provided by SBI SECURITIES Co., Ltd. insecurely loads Dynamic Link Libraries. Uncontrolled search path element CWE-427 - CVE-2026-42936 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

GHSA-V75C-CRR9-733C

creationtimestamp| type| source ---|---|--- 2026-07-15 04:34:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w...

CVE-2026-8919

creationtimestamp| type| source ---|---|--- 2026-07-15 04:14:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnubvidgw2i 2026-07-15 16:45:13+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:43:47+00:00| seen|...

CVE-2026-11851

creationtimestamp| type| source ---|---|--- 2026-07-15 03:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntgzdrcl2h 2026-07-27 21:44:30+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrnukc62nc2s...

CVE-2026-47998

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:13+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswby5gi2t...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...

Malicious Package

Overview @hkyyy/portal-widget-helper-0601 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...