Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict via the assertValidHost function. An attacker can cause security or routing decisions to be made based on a mismatched host by crafting a URI with authority delimiters, embedded ports, or malformed IPv6 brackets...

CVE-2026-0280

creationtimestamp| type| source ---|---|--- 2026-07-08 17:38:13+00:00| seen| https://bsky.app/profile/scotthogg.bsky.social/post/3mq5nwfhtlc2s 2026-07-08 19:03:27+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sossn5l2f 2026-07-09 04:46:13+00:00| seen|...

CVE-2026-15067

creationtimestamp| type| source ---|---|--- 2026-07-08 17:30:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nict4ia2k...

PYSEC-2026-2211

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-59887

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...

CVE-2026-59930

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable tocN values without slugifying the heading text, allowing attacker-controlled id="tocN" content to collide with generated anchors and...

UBUNTU-CVE-2026-59882

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

UBUNTU-CVE-2026-39822

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

UBUNTU-CVE-2026-59924

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory wh...

CVE-2018-20603

creationtimestamp| type| source ---|---|--- 2026-07-08 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5m6saptz2m...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

CVE-2026-56298

creationtimestamp| type| source ---|---|--- 2026-07-08 16:37:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5kj564gz27...

CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

CVE-2026-41042

creationtimestamp| type| source ---|---|--- 2026-07-08 16:20:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5jlooecl2f 2026-07-08 16:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5jrsw37s22 2026-08-17 18:00:03+00:00| seen|...

CVE-2026-59725

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated...

Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass

A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain...

UBUNTU-CVE-2026-59868

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-14454

creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5jcpi77c2k 2026-07-09 17:26:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqa5po5axo24...

CVE-2026-59253

creationtimestamp| type| source ---|---|--- 2026-07-08 16:12:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5j5g5ct72l...

CVE-2026-59895

Hono (server-side JS framework) contains a CS/XSS flaw in cx() within hono/css: class name construction concatenates strings and marks the result as pre-escaped, bypassing HTML escaping. This allows untrusted className values used in a JSX class attribute during server-side rendering to break out...