CVE-2026-51599

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding...

Linux Distros Unpatched Vulnerability : CVE-2026-59869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js- yaml can spend quadratic CPU time parsing a document...

CVE-2026-51603

CVE-2026-51603 affects Tenda CP3 V3.0 with firmware V31.1.9.91, where the RTSP service is vulnerable to a stack-based buffer overflow via a crafted second SETUP request after a legitimate first SETUP. The issue arises in the second-stage URL routing parser when validating the URL length, allowing...

CVE-2026-51602

CVE-2026-51602 describes a stack-based buffer overflow in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted SETUP request. The root cause is the second-stage URL routing parser failing to validate the le...

CVE-2026-15121

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15121

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-59802

creationtimestamp| type| source ---|---|--- 2026-07-08 21:47:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq63ty5zuw25 2026-07-09 00:15:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59802...

CVE-2026-57480 Parse Server: Denial of service via exponential-time processing of deeply nested query operators

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-57480 Parse Server: Denial of service via exponential-time processing of deeply nested query operators

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

CVE-2026-59890

creationtimestamp| type| source ---|---|--- 2026-07-08 19:55:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5vm6vmlj2i 2026-07-21 20:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h35f-9h28-mq5c 2026-07-22 12:00:52+00:00| seen|...

CVE-2026-59928

creationtimestamp| type| source ---|---|--- 2026-07-08 19:26:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5txl3tsx25 2026-07-20 22:36:50+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q...

CVE-2026-59896

creationtimestamp| type| source ---|---|--- 2026-07-08 19:16:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tg7c5df2g 2026-07-11 01:46:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdk5bfkh22e...

CVE-2026-59937

creationtimestamp| type| source ---|---|--- 2026-07-08 19:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5sz3djzo2i...

CVE-2026-0282

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:50+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5spheeb723 2026-07-09 04:46:18+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 21:04:25+00:00| seen...

CVE-2026-0286

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:22+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soorub227 2026-07-09 04:46:28+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:59:24+00:00| seen...

MAL-2026-7016 Malicious code in @vraksha/gh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12 On npm install, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload,...

Malicious code in crypto-promiser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88 [email protected] is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall...

MAL-2026-7010 Malicious code in crypto-promiser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88 [email protected] is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall...

MAL-2026-7014 Malicious code in vps-new-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7 The package's main entry dist/index.js re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of...