CVE-2026-13946

creationtimestamp| type| source ---|---|--- 2026-07-01 21:08:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgfdoyw52o 2026-07-02 07:46:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 11:40:19+00:00| seen|...

CVE-2026-55660 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-55660

CVE-2026-55660 : TinaCMS and Tinacms app prior to versions 2.5.6 / 3.9.3 allow cross-origin postMessage abuse due to window message listeners that do not validate event.origin/source and post to non-specific origins, combined with insufficient URL sanitization in rich-text content. This enables s...

CVE-2026-55660 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-14209

creationtimestamp| type| source ---|---|--- 2026-07-01 20:59:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpmfved2rg2n 2026-07-02 12:24:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnzmqi6co2w...

MAL-2026-6715 Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

MAL-2026-6716 Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-13874

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevvwwou2b 2026-07-02 07:21:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:29+00:00| seen|...

CVE-2026-13873

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevc452j2o 2026-07-02 07:21:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:24+00:00| seen|...

CVE-2026-49119

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmeva52lk2i 2026-07-02 10:29:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt6rcytn2m 2026-07-02 10:29:49+00:00| seen|...

CVE-2026-13877

creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmekvu2dg2q 2026-07-02 07:22:02+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:38+00:00| seen|...

CVE-2026-13872

creationtimestamp| type| source ---|---|--- 2026-07-01 20:25:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdyzavs424 2026-07-02 07:21:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-58517

creationtimestamp| type| source ---|---|--- 2026-07-01 20:19:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdoxmgz72v 2026-07-02 10:27:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt26cq262y 2026-07-02 11:56:50+00:00| seen|...

CVE-2026-13888

creationtimestamp| type| source ---|---|--- 2026-07-01 20:17:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdk6z7sk26 2026-07-02 07:22:29+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 18:59:00+00:00| seen|...

CVE-2026-41121

creationtimestamp| type| source ---|---|--- 2026-07-01 20:16:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdjlmofc2b 2026-07-02 10:31:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpntcdocin2m 2026-07-02 11:55:31+00:00| seen|...

CVE-2026-53467

creationtimestamp| type| source ---|---|--- 2026-07-01 20:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdenqcm72b 2026-07-02 09:56:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnrbw7ifn22 2026-07-02 11:55:52+00:00| seen|...

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...