CVE-2026-39964 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

EUVD-2026-31480

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

CVE-2026-39964 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

CVE-2026-39964 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

EUVD-2026-31459

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions...

SUSE-SU-2026:21785-1 Security update for cockpit

This update for cockpit fixes the following issues - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040. - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory...

BentoML 后置链接漏洞

BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.38 contained a post-link vulnerability. This vulnerability stemmed from the fact that the bui...

PT-2026-42817

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0 Description The Typebot viewer renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. This allows a bot author to set a link URL containing a malicious payload that...

CVE-2026-7890 Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a...

USN-8294-1 postgresql-14, postgresql-16, postgresql-17, postgresql-18 vulnerabilities

It was discovered that PostgreSQL did not correctly enforce authorization for CREATE TYPE. An attacker could possibly use this issue to execute arbitrary SQL functions. CVE-2026-6472 It was discovered that PostgreSQL incorrectly handled large user input in multiple server features. An attacker...

GHSA-9QGR-6VPG-9GH9 NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

Summary A reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and tag bindings without validation, allowing javascript: URI injection. Details PageLeavingWarning.vue reads ncRedirectUrl and ncBackUr...

CVE-2026-46473

creationtimestamp| type| source ---|---|--- 2026-05-21 19:56:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmf75oycuh2u 2026-05-21 21:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmfcut5yt22c 2026-05-22 00:00:39+00:00| seen|...

CVE-2026-47243

creationtimestamp| type| source ---|---|--- 2026-05-21 18:26:35+00:00| published-proof-of-concept| https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227 2026-05-21 19:08:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmf4lcuoc42m 2026-05-...

CVE-2026-48207

creationtimestamp| type| source ---|---|--- 2026-05-21 17:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmewkfjyo22j 2026-05-21 19:05:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4gxjw3k2o 2026-05-21 20:01:11+00:00| seen|...

CVE-2026-44051

A flaw was found in Netatalk. This vulnerability allows an attacker to perform arbitrary file reads by creating attacker-controlled symbolic links. This could lead to the disclosure of sensitive information on the affected system...

CVE-2026-44047

creationtimestamp| type| source ---|---|--- 2026-05-21 12:22:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmefv3mvyi25 2026-05-21 13:49:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmekqvbopl2r 2026-05-22 08:00:23+00:00| seen|...

MAL-2026-4373 Malicious code in @budetzz/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2dbcccc761971dfc5f844f59f362fe32ee1e0b9a3cd91ddd4fc87be5c8b013a The package is published under the name @budetzz/libsignal-node, impersonating the well-known libsignal Signal-protocol library, but the homepage and...

CVE-2026-6279

creationtimestamp| type| source ---|---|--- 2026-05-21 06:53:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdtj6esyd2t 2026-05-21 11:32:28+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mmed3x6lqk2s 2026-05-21 11:32:29+00:00| seen|...

CVE-2026-48172

creationtimestamp| type| source ---|---|--- 2026-05-21 02:46:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdfp7calj2e 2026-05-21 20:55:19+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116614555970411904 2026-05-22 23:04:03+00:00| seen|...

Netatalk 后置链接漏洞

Netatalk is an open-source software developed by Netatalk Inc. It provides AFP file server functionality for Classic Mac OS and macOS on Unix-like operating systems. Versions 3.0.2 to 4.4.2 of Netatalk had a post-release vulnerability due to improper link resolution. This vulnerability could allo...