PT-2026-58858

Name of the Vulnerable Software and Affected Versions jadx versions 1.5.2 through 1.5.5 Description A path traversal issue exists where a malicious .xapk file can cause the application to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory...

PT-2026-58831

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description A Server-Side Request Forgery SSRF issue exists that could lead to arbitrary code execution within the context of the current user. This flaw allows an attacker to inject...

PT-2026-58068

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description An issue exists where the Caldav::connect to server function in application/controllers/Caldav.php processes the caldav url variable without validating the scheme or host. This allows an...

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

CVE-2026-55475

creationtimestamp| type| source ---|---|--- 2026-07-13 23:24:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktlkikqr2d...

CVE-2026-55404

creationtimestamp| type| source ---|---|--- 2026-07-13 23:21:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktfz7kmj2d 2026-07-14 08:07:20+00:00| seen| https://gist.github.com/akib-h/a603a4aaf4aab24ac683c30e9a2ad670 2026-07-16 16:25:05+00:00| seen|...

CVE-2026-62195

creationtimestamp| type| source ---|---|--- 2026-07-13 23:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkt4djxzu2i 2026-07-15 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqoemwbh6j2f...

CVE-2026-62199

creationtimestamp| type| source ---|---|--- 2026-07-13 22:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrznklv22l 2026-07-15 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqohy7pg2g26...

CVE-2026-61458

creationtimestamp| type| source ---|---|--- 2026-07-13 22:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrqbq6nf2g...

CVE-2026-57800

creationtimestamp| type| source ---|---|--- 2026-07-13 22:18:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpvxla5u2d 2026-07-16 08:11:51+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqryzkfi72p...

CVE-2026-62242

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-15595

creationtimestamp| type| source ---|---|--- 2026-07-13 22:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkpr2dip426...

CVE-2026-58410

creationtimestamp| type| source ---|---|--- 2026-07-13 22:01:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkoxhvhd42i...

CVE-2026-12536

creationtimestamp| type| source ---|---|--- 2026-07-13 21:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqknu2mb5q2x...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

CVE-2026-58409 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...