CVE-2026-11321 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...

CVE-2026-15291

creationtimestamp| type| source ---|---|--- 2026-07-10 18:40:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcsdod5q62s 2026-07-12 19:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhugxoekp2m...

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...

GHSA-489G-7RXV-6C8Q MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...

Malicious code in buffer-util-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d329e426a3af00dc4cb53c8535a3e53848f09a1b80e561f84f29c77bffe746d7 Package impersonates Feross Aboukhadijeh's widely-used buffer package, copying its author, repository, contributors, and description metadata while...

CVE-2026-56765

creationtimestamp| type| source ---|---|--- 2026-07-10 16:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcltiwe322h 2026-07-12 07:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7kzfna2w...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the image process in open-sse/translator/concerns/image.js. An attacker can access internal-only HTTP services by...

Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

Malicious code in react-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b46ca6ae72ce6f079c34ec6d1d1d2be46b36fe429374393f0fe57539fe56ee3 Package name mimics the widely-used 'jsonwebtoken' library and falsely declares 'auth0' as author, while the repository URL points to the unrelated...

CVE-2026-57224

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...

CVE-2026-50178

creationtimestamp| type| source ---|---|--- 2026-07-10 12:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc5ztca3w25...

CVE-2026-56690

creationtimestamp| type| source ---|---|--- 2026-07-10 12:32:05+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqc5qu5luq2o 2026-07-10 12:53:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc6wpo2tm2i 2026-07-10 16:49:16+00:00| seen|...

CVE-2026-40454

creationtimestamp| type| source ---|---|--- 2026-07-10 11:11:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbz7ub5sf2f 2026-07-10 12:15:35+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40454 2026-07-10 13:34:44+00:00| seen|...

CVE-2026-41880

creationtimestamp| type| source ---|---|--- 2026-07-10 11:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbz2mejxm2h 2026-07-10 12:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116895569307199764 2026-07-10 12:00:37+00:00| seen|...

AI Surveillance and Social Progress

In the near future, AI-powered surveillance systems will be able to track everything we do in public, and much of what we do in private. And if we do something wrong--shoplift, litter, jaywalk, you name it--the system will notice, retain it, tie it to your official government record, communicate...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15330

creationtimestamp| type| source ---|---|--- 2026-07-10 09:57:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv4pxta22y...

CVE-2026-15332

creationtimestamp| type| source ---|---|--- 2026-07-10 09:34:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbttvnaer2a 2026-07-10 22:01:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd5l7hit62w...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-42860

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...