CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

Malicious code in px8my (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7da37dfbaa4b355a75e38c244bc5614299ecc5a1f3bc1dd072fdc7c4f2dc13b9 px8my's main entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL https://mfmz.gzhrjq.cn/H.html?c=0gjr...

MAL-2026-10108 Malicious code in url-func-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a4d96efb2897a3908596981acd2c0666cfd7445def91a32e02e2f95c9475ecf [email protected] exposes a factory createJsonService registered under key 'JsonS' in the public getFunc API that fetches...

CVE-2026-13080

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaozezmzg2f...

CVE-2026-57501

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

CVE-2026-54651

creationtimestamp| type| source ---|---|--- 2026-07-09 21:41:51+00:00| seen| https://gist.github.com/alon710/29f907693324d6187f6b141f2c73d47b...

CVE-2026-55207

CVE-2026-55207 affects Pimcore: an unauthenticated attacker who knows a valid admin username can hijack an admin account by abusing a malicious resetPasswordUrl in a password reset request. The server generates a real cryptographic recovery token, appends it to the attacker-controlled URL, emails...

CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server...

CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server...

Malicious code in fury_frontend-andes-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37 The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username os.userInfo, current working...

CVE-2026-54005

creationtimestamp| type| source ---|---|--- 2026-07-09 20:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqai4jjnxs24...

CVE-2026-13492

creationtimestamp| type| source ---|---|--- 2026-07-09 20:21:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahj5jc7c2x 2026-07-10 00:00:29+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqatqugq6z23...

CVE-2026-54002

creationtimestamp| type| source ---|---|--- 2026-07-09 20:11:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqagxaj5e62x...

CVE-2026-14904

creationtimestamp| type| source ---|---|--- 2026-07-09 20:03:40+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mqagjdixno2e...

CVE-2026-49274

creationtimestamp| type| source ---|---|--- 2026-07-09 19:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqag5munyo2x...

CVE-2026-58459

creationtimestamp| type| source ---|---|--- 2026-07-09 19:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqadagsstr26 2026-07-13 18:29:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd43obcc2x 2026-07-14 21:37:07+00:00| seen|...

CVE-2026-59826

creationtimestamp| type| source ---|---|--- 2026-07-09 18:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqab6hpfet2r 2026-07-09 18:43:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqabz6y7ax27 2026-07-16 14:04:29+00:00| seen|...