CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...

CVE-2026-14209

creationtimestamp| type| source ---|---|--- 2026-07-01 20:59:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpmfved2rg2n 2026-07-02 12:24:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnzmqi6co2w...

MAL-2026-6715 Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

MAL-2026-6716 Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-13874

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevvwwou2b 2026-07-02 07:21:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:29+00:00| seen|...

CVE-2026-13873

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmevc452j2o 2026-07-02 07:21:53+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:24+00:00| seen|...

CVE-2026-49119

creationtimestamp| type| source ---|---|--- 2026-07-01 20:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmeva52lk2i 2026-07-02 10:29:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt6rcytn2m 2026-07-02 10:29:49+00:00| seen|...

CVE-2026-13877

creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmekvu2dg2q 2026-07-02 07:22:02+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:38+00:00| seen|...

CVE-2026-13872

creationtimestamp| type| source ---|---|--- 2026-07-01 20:25:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdyzavs424 2026-07-02 07:21:51+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-58517

creationtimestamp| type| source ---|---|--- 2026-07-01 20:19:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdoxmgz72v 2026-07-02 10:27:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt26cq262y 2026-07-02 11:56:50+00:00| seen|...

CVE-2026-13888

creationtimestamp| type| source ---|---|--- 2026-07-01 20:17:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmdk6z7sk26 2026-07-02 07:22:29+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 18:59:00+00:00| seen|...

CVE-2026-41121

creationtimestamp| type| source ---|---|--- 2026-07-01 20:16:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdjlmofc2b 2026-07-02 10:31:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpntcdocin2m 2026-07-02 11:55:31+00:00| seen|...

CVE-2026-53467

creationtimestamp| type| source ---|---|--- 2026-07-01 20:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdenqcm72b 2026-07-02 09:56:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnrbw7ifn22 2026-07-02 11:55:52+00:00| seen|...

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

CVE-2026-13808

creationtimestamp| type| source ---|---|--- 2026-07-01 19:58:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmcj2exul2b 2026-07-02 01:10:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmtwdsjug2b 2026-07-02 07:19:21+00:00| seen|...

CVE-2026-13820

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmc2yccw72t 2026-07-02 07:19:47+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:47+00:00| seen|...

CVE-2026-13826

creationtimestamp| type| source ---|---|--- 2026-07-01 19:46:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbtkbi3d2y 2026-07-02 07:20:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13825

creationtimestamp| type| source ---|---|--- 2026-07-01 19:46:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbsku4gf2q 2026-07-02 07:19:58+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...