MAL-2026-5703 Malicious code in eslint-plugin-mistica-local-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d21f50741178986b63d1f330373131c2f3f502a5b94e76ca921ce185fab123 package.json declares a preinstall hook that runs index.js automatically on npm install. index.js collects host identity os.hostname, os.platform,...

CVE-2026-53982

creationtimestamp| type| source ---|---|--- 2026-06-12 18:44:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4fikpduf2f...

EUVD-2026-36536

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-10715 Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint

Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...

CVE-2026-45832

creationtimestamp| type| source ---|---|--- 2026-06-12 18:16:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dwdinmm2f...

CVE-2026-8828

creationtimestamp| type| source ---|---|--- 2026-06-12 18:12:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dqedpsk2j...

CVE-2026-45833

creationtimestamp| type| source ---|---|--- 2026-06-12 18:04:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dbluklu2x...

CVE-2026-12143

creationtimestamp| type| source ---|---|--- 2026-06-12 18:00:49+00:00| published-proof-of-concept| https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx 2026-06-12 21:57:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4qbo7oof23 2026-06-16 12:01:29+00:0...

CVE-2026-50090

creationtimestamp| type| source ---|---|--- 2026-06-12 17:46:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4cbmj3rq22 2026-06-13 10:30:34+00:00| seen| https://bsky.app/profile/michaelharley.net/post/3mo62ea7zms2p...

CVE-2026-47691

creationtimestamp| type| source ---|---|--- 2026-06-12 17:31:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4bgqtjp42j 2026-06-14 06:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moa3qqf4dd26 2026-06-15 03:07:08+00:00| seen|...

CVE-2026-50085

creationtimestamp| type| source ---|---|--- 2026-06-12 17:02:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo47sletpy2c 2026-06-12 17:52:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4cmenjg423 2026-06-13 18:11:30+00:00| seen|...

CVE-2026-9638

creationtimestamp| type| source ---|---|--- 2026-06-12 15:58:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo44a67sb42j 2026-06-12 18:29:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4enoz4jo22...

GHSA-24FP-5V3P-RVPW Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Summary Authenticated chisel clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A...

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Summary Authenticated chisel clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A...

CVE-2026-49347

creationtimestamp| type| source ---|---|--- 2026-06-12 13:36:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ud4luzf2r...

CVE-2026-47197

creationtimestamp| type| source ---|---|--- 2026-06-12 13:31:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3u265rbw2q...

CVE-2026-53943

creationtimestamp| type| source ---|---|--- 2026-06-12 09:45:53+00:00| seen| https://bsky.app/profile/cryptocat.me/post/3mo3hfsyulk2h 2026-07-02 21:19:58+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpoxjfntry2g...

CVE-2026-11535

creationtimestamp| type| source ---|---|--- 2026-06-12 09:17:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ftlbcoi25...

BIT-JENKINS-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...