CVE-2026-55760

Handlebars.java (Java) CVE-2026-55760 affects the library when user-controlled input is passed to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader. Prior to version 4.5.2, this allows path traversal and arbitrary file reads via template names derived from URL path paramete...

CVE-2026-59923

creationtimestamp| type| source ---|---|--- 2026-07-08 19:18:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tk2fuhz2t 2026-07-20 22:35:29+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3...

CVE-2026-59895

creationtimestamp| type| source ---|---|--- 2026-07-08 19:14:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tcmefry2e...

CVE-2026-0281

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:40+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sp77yxt2f 2026-07-09 04:46:15+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:27:26+00:00| seen...

CVE-2026-0278

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:37+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sp4zwv22m 2026-07-10 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0278...

Symlink Attack

Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Symlink Attack in the unarchive process when extracting zip or 7z archives containing symlink entries with a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. An...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the process that applies exclusion directives from MANIFEST.in due to improper Unicode normalization handling on macOS APFS or HFS+ filesystems. An attacker can cause unintended files to be...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict via the assertValidHost function. An attacker can cause security or routing decisions to be made based on a mismatched host by crafting a URI with authority delimiters, embedded ports, or malformed IPv6 brackets...

CVE-2026-0280

creationtimestamp| type| source ---|---|--- 2026-07-08 17:38:13+00:00| seen| https://bsky.app/profile/scotthogg.bsky.social/post/3mq5nwfhtlc2s 2026-07-08 19:03:27+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sossn5l2f 2026-07-09 04:46:13+00:00| seen|...

CVE-2026-15067

creationtimestamp| type| source ---|---|--- 2026-07-08 17:30:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nict4ia2k...

PYSEC-2026-2211

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-59887

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...

CVE-2026-59930

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable tocN values without slugifying the heading text, allowing attacker-controlled id="tocN" content to collide with generated anchors and...

UBUNTU-CVE-2026-39822

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

UBUNTU-CVE-2026-59882

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

UBUNTU-CVE-2026-59924

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory wh...

CVE-2018-20603

creationtimestamp| type| source ---|---|--- 2026-07-08 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5m6saptz2m...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

CVE-2026-56298

creationtimestamp| type| source ---|---|--- 2026-07-08 16:37:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5kj564gz27...

CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...