CVE-2026-55665

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-13461

creationtimestamp| type| source ---|---|--- 2026-07-10 21:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqd2wabcgv22...

CVE-2026-55789

creationtimestamp| type| source ---|---|--- 2026-07-10 21:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqd26i3vhl2k 2026-07-11 02:01:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdkxyc7jz2s...

CVE-2026-55665 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-57575 Misskey: SSRF bypass in URL Preview

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

CVE-2026-57575

Misskey (open source federated social platform) contains a Server-Side Request Forgery (SSRF) vulnerability in the UrlPreviewService prior to version 2026.6.0. The issue arises from insufficient network restrictions before outbound requests, allowing an attacker to trigger the Misskey server to i...

CVE-2026-55881

OpenReplay (self-hosted session replay) versions affected: 1.22.0 – 1.27.0. The vulnerability arises in getFirstMob where 15-second presigned S3 download URLs for a session’s DOM-replay recording were generated based only on the session path, while validateProjectAccess only checked tenant owners...

CVE-2026-55404

A flaw was found in yt-dlp and youtube-dl, command-line tools for downloading audio and video. This vulnerability allows an attacker to inject malicious code into shortcut files .url or .desktop when certain options, such as --write-link, are used. By manipulating the webpageurl or filename...

CVE-2026-55478

creationtimestamp| type| source ---|---|--- 2026-07-10 20:24:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcy666gy22k 2026-07-11 01:10:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdi5jpwji2s...

CVE-2026-55474

creationtimestamp| type| source ---|---|--- 2026-07-10 20:19:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxtv2z5a27 2026-07-11 01:06:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhwmqcop2w...

CVE-2026-6872

creationtimestamp| type| source ---|---|--- 2026-07-10 20:16:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxpfnoro2x...

CVE-2026-54089

creationtimestamp| type| source ---|---|--- 2026-07-10 20:16:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcxoiwmmg2z 2026-07-10 20:35:14+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm 2026-07-11...

CVE-2026-53449

creationtimestamp| type| source ---|---|--- 2026-07-10 20:14:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxlbbnuh2i 2026-07-11 01:02:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhnsjwyw2w 2026-07-14 04:51:38+00:00| seen|...

GHSA-7835-87Q9-RGVV

creationtimestamp| type| source ---|---|--- 2026-07-10 20:08:54+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3mqcxbpjci62k...

CVE-2026-55460

creationtimestamp| type| source ---|---|--- 2026-07-10 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxahqevc2l 2026-07-11 01:12:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdiailwdp2y...

CVE-2026-55843

creationtimestamp| type| source ---|---|--- 2026-07-10 20:07:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcx6o6zfz2g 2026-07-11 01:01:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhmz3k6w2f...

CVE-2026-53450

creationtimestamp| type| source ---|---|--- 2026-07-10 20:02:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcwvpqku22i 2026-07-11 01:02:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhogqben2e...

CVE-2026-54329

creationtimestamp| type| source ---|---|--- 2026-07-10 19:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcwmrbo5x25 2026-07-11 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqf5agynjb2r...

CVE-2026-54070

creationtimestamp| type| source ---|---|--- 2026-07-10 19:42:40+00:00| seen| https://gist.github.com/alon710/b90f7da9d543dd51155aefe8a87d6f66 2026-07-10 20:35:11+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w7cg-whh7-xp28...

CVE-2026-59151

creationtimestamp| type| source ---|---|--- 2026-07-10 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsuscyeq2z 2026-07-10 20:36:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcysjpafd2g 2026-07-11 01:13:41+00:00| seen|...