EUVD-2026-40862

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

CVE-2026-57963

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

CVE-2026-57963

The CVE-2026-57963 issue affects chat UI in Thunderbird where an attacker able to send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Underlying risk is manipulation of the chat interface and potential phishing wi...

CVE-2026-57963 Chat UI manipulation by injection

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

PT-2026-54448

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.12.1 Thunderbird versions prior to 152.0.1 Description An attacker can inject arbitrary styled content, phishing links, and CSS to manipulate the chat UI by sending HTML chat messages via Matrix or XMPP...

CVE-2026-56224 Capgo - Login CSRF and Session Fixation via URL Query Parameters

Capgo console.capgo.app/login before 12.128.2 accepts accesstoken and refreshtoken in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs...

CVE-2026-10564

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery SSRF. The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker c...

EUVD-2026-40290

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches captu...

PT-2026-54015

Name of the Vulnerable Software and Affected Versions Storage Concentrator SC & SCVM affected versions not specified Description Reflected cross-site scripting occurs because unsanitized content is echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an...

CVE-2026-54888

creationtimestamp| type| source ---|---|--- 2026-06-29 22:33:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphka2ti2e27 2026-06-29 23:30:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphnfwlsoh2d...

CVE-2026-13762

creationtimestamp| type| source ---|---|--- 2026-06-29 22:08:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mphiu4vkl324 2026-06-29 22:50:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphl6qlfck2s 2026-06-29 23:12:40+00:00| seen|...

CVE-2026-53426

creationtimestamp| type| source ---|---|--- 2026-06-29 22:01:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphiguy5rn2x 2026-06-29 22:36:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkestmkb2d 2026-06-29 23:20:45+00:00| seen|...

CVE-2026-56017

creationtimestamp| type| source ---|---|--- 2026-06-29 22:01:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphigjaxpm2d 2026-06-29 22:37:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkhbvg2r2o 2026-06-29 23:50:11+00:00| seen|...

dotnet: .NET: Local file tampering via link following vulnerability

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...

CVE-2026-13751

creationtimestamp| type| source ---|---|--- 2026-06-29 17:54:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2nxm6hf2t 2026-06-29 18:43:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5feg6v52o 2026-06-29 20:15:46+00:00| seen|...

CVE-2026-57327

creationtimestamp| type| source ---|---|--- 2026-06-29 16:27:30+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpgvrp3nho24 2026-06-29 16:27:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgvrtl7ka2n...

CVE-2026-57336

creationtimestamp| type| source ---|---|--- 2026-06-29 16:12:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguxcjsyv2d 2026-06-29 16:46:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgwtct4wo2w 2026-06-29 20:44:54+00:00| seen|...

CVE-2026-57329

creationtimestamp| type| source ---|---|--- 2026-06-29 16:11:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguvpeeku2d 2026-06-29 16:11:55+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpguvtbqfo2w...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...