CVE-2026-59925

creationtimestamp| type| source ---|---|--- 2026-07-08 19:12:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5t7agm7s2z 2026-07-20 22:35:31+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45...

CVE-2026-0282

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:50+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5spheeb723 2026-07-09 04:46:18+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 21:04:25+00:00| seen...

CVE-2026-0281

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:40+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sp77yxt2f 2026-07-09 04:46:15+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:27:26+00:00| seen...

CVE-2026-0276

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:30+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sow2ip32c 2026-07-10 00:15:07+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0276...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the safeurl process. An attacker can inject malicious URLs into rendered href and src attributes by crafting links that use legacy or chained schemes, potentially leading to script execution in affected user...

CVE-2026-59703

creationtimestamp| type| source ---|---|--- 2026-07-08 18:02:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pbiipf427...

Malicious code in crypto-promiser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88 [email protected] is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall...

CVE-2026-15067

creationtimestamp| type| source ---|---|--- 2026-07-08 17:30:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nict4ia2k...

DEBIAN-CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-59923

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

PYSEC-2026-2211

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-55075

creationtimestamp| type| source ---|---|--- 2026-07-08 17:07:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq5m7qsymz26...

MAL-2026-6999 Malicious code in luludawang-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...

CVE-2026-49145

creationtimestamp| type| source ---|---|--- 2026-07-08 16:30:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5k5n2qyc24...

CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-6740

creationtimestamp| type| source ---|---|--- 2026-07-08 16:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq5jdlqkpu22...

CVE-2026-0288

creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:21+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116885246523577101 2026-07-08 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soxii4n22 2026-07-08 20:15:02+00:00| seen|...

CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...