EUVD-2026-39779

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery SS...

CVE-2026-57202

creationtimestamp| type| source ---|---|--- 2026-06-26 14:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp76evoqrj2e...

CVE-2026-57925

creationtimestamp| type| source ---|---|--- 2026-06-26 14:23:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp75hf5qcd2p...

CVE-2026-55667

creationtimestamp| type| source ---|---|--- 2026-06-26 14:01:48+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp74aezucd2b 2026-07-20 22:37:35+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr...

CVE-2026-40711

creationtimestamp| type| source ---|---|--- 2026-06-26 13:25:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp727idquu2a...

CVE-2026-57940

CVE-2026-57940 affects HTMLy 3.1.1 and describes an SSRF in the RSS feed import. The vulnerable code path is get_feed() in system/admin/admin.php, which passes user-supplied feed_url directly to file_get_contents() without validation. An authenticated admin can exploit this by supplying a crafted...

CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

RLSA-2026:29195 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RLSA-2026:29703 Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

CVE-2026-13226

creationtimestamp| type| source ---|---|--- 2026-06-26 11:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6swdzbgx26...

CVE-2026-1869

creationtimestamp| type| source ---|---|--- 2026-06-26 10:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6oqm63do2a 2026-06-26 12:15:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6wbqixpl22...

CVE-2026-57877

creationtimestamp| type| source ---|---|--- 2026-06-26 09:15:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6ma3ng532x...

CVE-2017-4997

creationtimestamp| type| source ---|---|--- 2026-06-26 09:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp6lrgnmto2h...

CVE-2026-39830

creationtimestamp| type| source ---|---|--- 2026-06-26 07:43:14+00:00| seen| https://gist.github.com/alon710/88958f43b0e7690b6916b9cfa5c9b9df 2026-07-15 16:40:07+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5wvyuvz2h...

CVE-2017-14507

creationtimestamp| type| source ---|---|--- 2026-06-26 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp6bpkzf2u2y...

Malicious code in react-context-form-tdsss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a53e75a65681ee9ea818634ddee1ed52c6c8398dbd68e2b6abca255b24aaf37 [email protected] is a dependency-confusion payload. package.json declares scripts.preinstall="node index.js", and index.js issues an...

CVE-2026-8797

creationtimestamp| type| source ---|---|--- 2026-06-26 05:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp66slptia27 2026-06-26 05:45:02+00:00| seen| https://jvn.jp/en/jp/JVN35146924 2026-06-26 06:00:28+00:00| seen|...

MAL-2026-6503 Malicious code in js-price-client-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763a44df6481ee1948ff9fda0b3997a93001acb138b7bbcba1787c3f2f8699f2 On npm install, the package's postinstall script invokes prices in dist/index.js, which resolves the consumer's project root via process.env.INITCWD?...

MAL-2026-6497 Malicious code in chai-as-synced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be17d22b28dc53ea46085190c1f5ff11ae16ce4b80539162d68c2ad2b224158e [email protected] impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout proto.js, levels.js,...