SUSE CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

GHSA-38HQ-7X33-PHP4 @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

CVE-2026-53402

creationtimestamp| type| source ---|---|--- 2026-07-24 13:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhb3ikw42o 2026-08-06 04:46:30+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...

CVE-2026-63317

creationtimestamp| type| source ---|---|--- 2026-07-24 12:53:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrffhds5hm2d...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

OESA-2026-3171 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like...

OESA-2026-3142 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Handling of URL Encodi...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-7483

creationtimestamp| type| source ---|---|--- 2026-07-24 10:15:43+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrf4nvc42o2v 2026-07-24 13:25:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhaohidj2g 2026-07-25 08:08:14+00:00| seen|...

CVE-2026-12981

creationtimestamp| type| source ---|---|--- 2026-07-24 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116973779458861264 2026-07-24 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mretgfvnq42h 2026-07-24 21:52:27+00:00| seen|...

CVE-2024-58354

creationtimestamp| type| source ---|---|--- 2026-07-24 03:33:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mreg5zx7qd2o...

CVE-2026-56191

creationtimestamp| type| source ---|---|--- 2026-07-24 00:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mre3pj76me23 2026-07-24 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mreee4ela22q 2026-07-24 04:30:27+00:00| seen|...

PT-2026-64409

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A stored cross-site scripting issue exists in the @milkdown/preset-commonmark and @milkdown/components packages. Attackers with document write access can execute arbitrary JavaScript in the browser...

PT-2026-64276

Name of the Vulnerable Software and Affected Versions Google Cloud Looker versions prior to 25.6.103 Google Cloud Looker versions prior to 25.12.65 Google Cloud Looker versions prior to 25.18.68 Google Cloud Looker versions prior to 26.0.66 Google Cloud Looker versions prior to 26.2.47 Google Clo...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-16805

creationtimestamp| type| source ---|---|--- 2026-07-23 22:15:23+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971596854729313 2026-07-24 12:45:43+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-64 2026-07-24 13:30:23+00:00| seen|...

CVE-2026-15981

creationtimestamp| type| source ---|---|--- 2026-07-23 21:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdrcxw2hw2y 2026-07-26 10:01:16+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrk4rv32bq2i 2026-07-26 15:00:28+00:00| seen|...

CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-63313

9Router before 0.4.72 is affected by a server-side request forgery (SSRF) in the /v1/web/fetch endpoint. The endpoint accepts a user-supplied url and passes it to an external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa). Validation only checks syntactic correctness via new URL(), wi...

CVE-2026-61170

creationtimestamp| type| source ---|---|--- 2026-07-23 18:16:42+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-08-01 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mry6eybgyc2e...