CVE-2026-50338

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:02+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0233 2026-07-14 22:02:32+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:56+00:00| seen|...

CVE-2026-50522

creationtimestamp| type| source ---|---|--- 2026-07-14 18:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmufqojqv2b 2026-07-14 19:00:52+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 21:00:04+00:00| seen| https://t.me/kasperskyb2b/2258...

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic appears incomplete. The validatePublicUrl protection relies on isValidPublicIPv4Address to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of timeout configuration in the http.DefaultClient used for remote post-serve actions. An attacker can exhaust system memory and crash the process by registering a...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

CVE-2026-42990

creationtimestamp| type| source ---|---|--- 2026-07-14 17:58:46+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116919627031476451 2026-07-14 18:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmu6l7yux2z 2026-07-14 19:01:38+00:00| seen|...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

CVE-2026-62656

The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...

CVE-2026-62658

NETGEAR Nighthawk RAX series routers (RAX45, RAX43, RAX50, RAX54sv2) are affected by CVE-2026-62658, a post-authentication vulnerability that could allow a logged-in user to execute arbitrary commands or code on the device. The CVSS 4.0 base score is 5.7 (MEDIUM) with high integrity impact and ad...

Use of Password System for Primary Authentication

Overview Affected versions of this package are vulnerable to Use of Password System for Primary Authentication via the AddServiceKey function. An attacker can overwrite sensitive credential files and inject malicious content by sending unauthenticated POST requests to the /serviceKey endpoint,...

CVE-2026-60081

creationtimestamp| type| source ---|---|--- 2026-07-14 17:06:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmowgjxe624...

CVE-2026-15392

creationtimestamp| type| source ---|---|--- 2026-07-14 16:56:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmoehb2hv24 2026-07-17 08:06:33+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqtc6h73t72z 2026-07-17 08:06:52+00:00| seen|...

CVE-2026-58476

creationtimestamp| type| source ---|---|--- 2026-07-14 16:42:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnn6ps442w 2026-07-22 05:00:05+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr7k3mofxu2v...

CVE-2025-12012

creationtimestamp| type| source ---|---|--- 2026-07-14 16:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmmw4rlo42t 2026-07-16 16:15:45+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06 2026-07-22 04:55:00+00:00| seen|...

CVE-2025-12011

creationtimestamp| type| source ---|---|--- 2026-07-14 16:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmmw375fu2t 2026-07-16 16:15:43+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06...

CVE-2026-60114

creationtimestamp| type| source ---|---|--- 2026-07-14 16:03:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmlgnpvta2e 2026-07-17 11:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqtmbder3e2n 2026-07-22 04:56:06+00:00| seen|...

CVE-2026-58475

creationtimestamp| type| source ---|---|--- 2026-07-14 15:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqml5byefk2g...

CVE-2026-15736

creationtimestamp| type| source ---|---|--- 2026-07-14 15:51:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkrptyjv2l 2026-07-22 05:04:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kdanyfb2i...

CVE-2026-14903

creationtimestamp| type| source ---|---|--- 2026-07-14 15:49:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkoeal2u2x 2026-07-14 21:19:56+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-696 2026-07-22 05:10:33+00:00| seen|...