40395 matches found
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
Summary When fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP,...
CVE-2024-38487
creationtimestamp| type| source ---|---|--- 2026-06-16 18:18:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogfvsfgfv25...
CVE-2026-39926
creationtimestamp| type| source ---|---|--- 2026-06-16 18:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogffk4tif2k...
CVE-2026-42089
creationtimestamp| type| source ---|---|--- 2026-06-16 18:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogewmaa2s2a 2026-06-16 18:51:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moghr2ie5m2x 2026-07-16 19:00:31+00:00| seen|...
CVE-2026-10639
In Zephyr's native IPv4 stack, icmpv4handleechorequest in subsys/net/ip/icmpv4.c builds an echo-reply packet reply, hands it to nettrysenddata, and then, on success, calls netstatsupdateicmpsentnetpktifacereply. nettrysenddata transfers ownership of reply to the TX path netiftryqueuetx - netiftx ...
CVE-2026-9006
creationtimestamp| type| source ---|---|--- 2026-06-16 15:00:06+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3mog2tg6zxc24 2026-06-16 15:10:04+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3mog3fas22c2h 2026-07-02 08:27:48+00:00| seen|...
CVE-2026-12328
creationtimestamp| type| source ---|---|--- 2026-06-16 14:58:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mog2qgnwtj2x 2026-06-16 17:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogbl2aocw2f 2026-06-17 20:00:00+00:00| seen|...
CVE-2026-12321
creationtimestamp| type| source ---|---|--- 2026-06-16 14:22:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofypc7tz32b 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
CVE-2026-12325
creationtimestamp| type| source ---|---|--- 2026-06-16 14:13:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofyakf6b62i 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
CVE-2026-12317
creationtimestamp| type| source ---|---|--- 2026-06-16 14:09:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxykytm32n 2026-06-17 04:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mohghhjt2s2o 2026-06-17 20:00:00+00:00| seen|...
CVE-2026-53900
creationtimestamp| type| source ---|---|--- 2026-06-16 14:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxrmn5go2g 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
CVE-2025-68045
creationtimestamp| type| source ---|---|--- 2026-06-16 14:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofxjsavxg2n...
CVE-2026-53899
creationtimestamp| type| source ---|---|--- 2026-06-16 13:58:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxfuqupl2j 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
BIT-DISCOURSE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user with access to the AI...
BIT-DISCOURSE-2026-44782 Discourse: GroupPostSerializer leaks hidden full names through reaction post association
Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, GroupPostSerializer declared includeuserlongname? as the predicate for its :name attribute, but AMS looks for includename?. The misnamed...
mythox-opencode-cyber
⬡ MYTHOX CYBER OPS — OpenCode Agent Suite 6 agents متخصصو...
CVE-2026-39574
creationtimestamp| type| source ---|---|--- 2026-06-16 11:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofnjg5v3u2n 2026-06-16 13:52:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofx34pvne2g...
CVE-2026-8176
creationtimestamp| type| source ---|---|--- 2026-06-16 11:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofniyneli2d...
CVE-2026-8442
creationtimestamp| type| source ---|---|--- 2026-06-16 11:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofnhbv7um2t 2026-06-16 13:57:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxe36bfh2f...