JLSEC-2026-99

Deno =1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory...

Malicious code in ms-affiliate-links (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341048b16926b4d40796ca96aef3816934a2b84602c26451638154b6d90ab5d8 The package ms-affiliate-links was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview ms-affiliate-links is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2643 Malicious code in ms-affiliate-links (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341048b16926b4d40796ca96aef3816934a2b84602c26451638154b6d90ab5d8 The package ms-affiliate-links was found to contain malicious code. Source: ghsa-malware...

Server-Side Request Forgery (SSRF)

github.com/jon4hz/jellysweep is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the URL parameter in the /api/images/cache endpoint, which allows an authenticated attacker to make the server download arbitrary content from attacker-controlled URL...

CVE-2026-27683

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact...

Docmost 跨站脚本漏洞

Docmost is an open-source collaborative wiki and documentation software developed by Docmost. Versions of Docmost prior to 0.71.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of attachment URLs, which could allow low-privilege authenticated use...

PT-2026-32763

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser...

PT-2026-32561

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact...

CVE-2026-32605

creationtimestamp| type| source ---|---|--- 2026-04-13 20:09:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjfocllhi42g 2026-04-13 21:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjfr5afisj2p 2026-04-13 21:22:51+00:00| published-proof-of-concept|...

CVE-2026-40039

CVE-2026-40039 concerns Pachno 1.0.6. The issue is an open redirection in the login flow caused by unvalidated return_to values, enabling attackers to craft links that redirect users to arbitrary external sites for phishing and credential theft. The vulnerability affects the return_to parameter h...

EUVD-2026-22011

ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...

vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system OS command injection vulnerability exists in the netrw standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the scp://...

CVE-2026-6154

creationtimestamp| type| source ---|---|--- 2026-04-13 05:18:10+00:00| published-proof-of-concept| Telegram/38C7MAAhnpHd5NceAwXcFYw5n56xIYZ8i0J7F3P3ZbI98 2026-04-13 05:46:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mje623ywvn2h 2026-04-13 05:53:27+00:00| seen|...

CVE-2026-6155

creationtimestamp| type| source ---|---|--- 2026-04-13 04:17:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjdz3p4yk72k 2026-04-13 05:18:10+00:00| published-proof-of-concept| Telegram/38C7MAAhnpHd5NceAwXcFYw5n56xIYZ8i0J7F3P3ZbI98 2026-04-13 05:43:26+00:00| seen|...

Linux Distros Unpatched Vulnerability : CVE-2026-3466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0...

[SECURITY] Fedora 42 Update: mupdf-1.26.3-6.fc42

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

[SECURITY] Fedora 43 Update: mupdf-1.27.1-10.fc43

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

CVE-2017-20239 MDwiki Cross-Site Scripting via Location Hash Parameter

MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the location hash parameter. Attackers can craft URLs with JavaScript payloads in the hash fragment that are parsed and rendered without...

CVE-2026-6123

creationtimestamp| type| source ---|---|--- 2026-04-12 09:43:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjc2tb5aus22 2026-04-12 10:23:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjc52jcvgk2g 2026-04-12 11:15:38+00:00| published-proof-of-concept|...