GHSA-4328-8HGF-7WJR

creationtimestamp| type| source ---|---|--- 2026-07-31 19:38:28+00:00| seen| https://gist.github.com/konard/91df17bf902150322c465ca6b6479053...

CVE-2026-53504

creationtimestamp| type| source ---|---|--- 2026-07-31 19:31:28+00:00| seen| https://gist.github.com/alon710/de1c5b8263f3d3a5d1101a3c2a0269ab 2026-07-31 20:35:27+00:00| published-proof-of-concept| https://github.com/thumbor/thumbor/security/advisories/GHSA-5vjc-7cxw-4w6j...

EUVD-2026-51621

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-15969

creationtimestamp| type| source ---|---|--- 2026-07-31 19:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxndlbvkx2h 2026-08-05 14:27:15+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdqcbbsp726 2026-08-06 03:18:46+00:00| seen|...

GHSA-MJ3G-7XCC-X4VH

creationtimestamp| type| source ---|---|--- 2026-07-31 18:32:14+00:00| seen| https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5...

CVE-2026-18481

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

GHSA-XRMJ-5G4G-8987

creationtimestamp| type| source ---|---|--- 2026-07-31 16:33:01+00:00| seen| https://gist.github.com/alon710/e1fe3e68fe3d799c84bb3e82e35d7e46...

K000162711: Vim vulnerability CVE-2026-28417

Security Advisory Description Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can...

CVE-2025-69938

creationtimestamp| type| source ---|---|--- 2026-07-31 15:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcmapwft2y...

CVE-2026-28812

creationtimestamp| type| source ---|---|--- 2026-07-31 15:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcm7hwyh2z...

CVE-2025-69941

creationtimestamp| type| source ---|---|--- 2026-07-31 15:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxcf26mcq2q...

CVE-2026-27060

creationtimestamp| type| source ---|---|--- 2026-07-31 15:44:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxcbkstiw2u 2026-07-31 17:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxiy5imiu2q...

CVE-2026-68577

creationtimestamp| type| source ---|---|--- 2026-07-31 14:12:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jef76ycbxltzi...

CVE-2026-68576

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-52539

creationtimestamp| type| source ---|---|--- 2026-07-31 12:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwxk5vccl2e...

EUVD-2026-51527

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

GHSA-XPXJ-F2FM-RQCH

creationtimestamp| type| source ---|---|--- 2026-07-31 10:32:17+00:00| seen| https://gist.github.com/alon710/ebcd683ed5c708ce9306a8ed3912a91a...

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

CVE-2026-11770

creationtimestamp| type| source ---|---|--- 2026-07-31 10:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4264s2zafk3mq 2026-07-31 12:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrwvrz7cro2l...