claudit

claudit – AI-based code security auditing tool claudit is an...

CVE-2026-66747

creationtimestamp| type| source ---|---|--- 2026-08-05 10:34:46+00:00| seen| https://infosec.exchange/users/catc0n/statuses/117042451920559868 2026-08-05 11:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b 2026-08-05 18:04:52+00:00| seen|...

CVE-2026-10059

creationtimestamp| type| source ---|---|--- 2026-08-05 10:16:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bxonml2lzenjs 2026-08-05 10:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcmcvyui2l 2026-08-05 11:30:28+00:00| seen|...

MAL-2026-12212 Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

CVE-2026-4431

creationtimestamp| type| source ---|---|--- 2026-08-05 09:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117042081155295833 2026-08-05 09:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msd62grcf32o 2026-08-05 09:20:04+00:00| seen|...

CVE-2026-12259

A flaw was found in nltk. The nltk.downloader.Downloader.downloadpackage function does not enforce SHA-256 or MD5 checksum validation before writing and extracting downloaded package bytes to disk. A remote attacker can exploit this by tampering with the package response body through a compromise...

CVE-2026-9273

creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/117041373701599609 2026-08-05 06:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msctyppdsc2t 2026-08-05 07:04:04+00:00| seen|...

CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

CVE-2026-18859

creationtimestamp| type| source ---|---|--- 2026-08-05 02:24:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3colvpruqxjrw 2026-08-05 02:26:09+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mschzbyjyi2l...

Linux Distros Unpatched Vulnerability : CVE-2026-53500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escapi...

CVE-2026-70619

creationtimestamp| type| source ---|---|--- 2026-08-04 22:09:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dqncya2mxc36p 2026-08-04 23:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc4jhvpk42n...

YayTune_PoC

YayTunePoC This is a repository dedicated to technical test...

CVE-2026-70553

creationtimestamp| type| source ---|---|--- 2026-08-04 20:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt7x7g372u 2026-08-04 21:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbvszpbyv2t 2026-08-05 01:30:33+00:00| seen|...

CVE-2026-69110

creationtimestamp| type| source ---|---|--- 2026-08-04 16:46:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hx2djdxo2nr7y 2026-08-04 17:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbige4sax2t 2026-08-04 18:12:05+00:00| seen|...

CVE-2026-24084

creationtimestamp| type| source ---|---|--- 2026-08-04 16:45:07+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-10 2026-08-04 17:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbihzi5um2t 2026-08-04 23:13:51+00:00| seen|...

CVE-2026-67247

creationtimestamp| type| source ---|---|--- 2026-08-04 14:27:48+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7ureywf25 2026-08-04 14:59:23+00:00| seen| https://bsky.app/profile/potato.software/post/3msbbnaqvro2i...

CVE-2026-60007

creationtimestamp| type| source ---|---|--- 2026-08-04 13:30:24+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msb4o36xrd2i 2026-08-04 13:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117037480022382500 2026-08-04 14:06:28+00:00| seen|...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

SummaryThe ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

PYSEC-2026-3617 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

ImpactThe relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...