CVE-2026-13817

creationtimestamp| type| source ---|---|--- 2026-07-01 19:31:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmayj5ohn2q 2026-07-02 07:19:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:41+00:00| seen|...

Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

CVE-2026-58520

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from before 1.43.9, 1.44.6, 1.45.4...

GHSA-PVRJ-8CG3-J5F8 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...

CVE-2026-58453

creationtimestamp| type| source ---|---|--- 2026-07-01 18:03:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpm43gkeax2q 2026-07-02 04:38:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7kvczst2l...

CVE-2025-36323

creationtimestamp| type| source ---|---|--- 2026-07-01 17:56:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm3o2pzsi24...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-34106

creationtimestamp| type| source ---|---|--- 2026-07-01 17:21:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplzpzlhhm26 2026-07-02 08:27:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnmej5alh2u...

CVE-2026-34098

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-58520

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from before 1.43.9, 1.44.6, 1.45.4...

CVE-2026-54399

creationtimestamp| type| source ---|---|--- 2026-07-01 16:56:39+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mplydnj46p2w 2026-07-02 04:41:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7qpaahw2r 2026-07-02 07:46:44+00:00| seen|...

CVE-2026-24248

creationtimestamp| type| source ---|---|--- 2026-07-01 16:35:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplx6mxczo2p 2026-07-02 04:34:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7downsd2l...

CVE-2026-58025

creationtimestamp| type| source ---|---|--- 2026-07-01 16:26:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplwmq2mzg2y 2026-07-02 02:49:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzi6sza72o 2026-07-02 04:32:41+00:00| seen|...

EUVD-2026-41061

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php line 124: SELECT FROM complex WHERE name='".$GET'name'."'. An authenticated attacker can perform error-based SQL injection to extract database contents...

CVE-2026-34098

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-24247

creationtimestamp| type| source ---|---|--- 2026-07-01 16:01:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplvbnh36e2i 2026-07-02 04:34:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7d2yb3a2o...

CVE-2026-6678

creationtimestamp| type| source ---|---|--- 2026-07-01 16:00:12+00:00| seen| https://infosec.place/objects/cf6e553c-bb60-4c89-9f17-6f2b54a2754a...

CVE-2026-58028

creationtimestamp| type| source ---|---|--- 2026-07-01 15:52:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplurpetfu26 2026-07-02 02:51:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzkujtyx27 2026-07-02 04:35:02+00:00| seen|...