112173 matches found
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and execut...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of user-supplied URLs in outgoing HTTP components, including notification channels, OIDC backchannel logout, and SAML metadata fetches. An attacker can access internal network resources...
CVE-2026-56007
creationtimestamp| type| source ---|---|--- 2026-06-18 12:09:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moksabt2hg2l...
CVE-2026-8811
creationtimestamp| type| source ---|---|--- 2026-06-18 12:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokrxde2si2f...
CVE-2025-10560
creationtimestamp| type| source ---|---|--- 2026-06-18 11:51:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokr7yb7hr2z...
CVE-2026-11358
creationtimestamp| type| source ---|---|--- 2026-06-18 08:12:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokexoj37z2u...
CVE-2026-12098
creationtimestamp| type| source ---|---|--- 2026-06-18 08:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokeivjn7e2z...
CVE-2026-12093
creationtimestamp| type| source ---|---|--- 2026-06-18 07:57:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moke5d5js727...
CVE-2026-49759
creationtimestamp| type| source ---|---|--- 2026-06-18 07:07:36+00:00| seen| https://bsky.app/profile/cyberowi.pl/post/3mokbedhmti25...
CVE-2026-40783
creationtimestamp| type| source ---|---|--- 2026-06-18 05:07:51+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mok2knrcv52i...
Malicious code in stackus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a8032b910c8971e79e7d8b0e250ce4d61fd2a2206d6b319a5aed50e32490456 On require, lib/writer.js loaded transitively from the package's main pino.js collects the installer's full process.env together with host identifier...
Mattermost Desktop 5.13.x < 5.13.6 / 6.x < 6.2.0 Multiple Vulnerabilities (MMSA-2026-00651 / MMSA-2026-00652)
The version of Mattermost Desktop installed on the remote host is affected by multiple vulnerabilities: - Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a...
Siemens RUGGEDCOM RST2428P Cross-site Scripting (CVE-2025-66412)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting XSS vulnerability has been identified in the Angular Template Compiler. It occurs because the...
Siemens RUGGEDCOM RST2428P Cross-site Scripting (CVE-2026-22610)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting XSS vulnerability has been identified in the Angular Template Compiler. The...
PT-2026-50815
Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description An open redirect exists in the multi-factor authentication MFA flow. The MFA validate and register endpoints, specifically '/mfa/validate', process the user-supplied next query or form parameter...
CVE-2026-48768
TypeBot (versions ≤ 3.16.1) exposes an unauthenticated generate-upload-url API (/api/blocks/file-input/v3/generate-upload-url) that uses unsanitized fileName to derive public S3 keys and issues presigned PUT URLs that do not bind Content-Type. This allows anonymous users of a published bot with a...
CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...
CVE-2026-55202
creationtimestamp| type| source ---|---|--- 2026-06-17 23:01:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg7gts3g27 2026-08-02 15:23:25+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4c2epkfr2c...
CVE-2026-55200
creationtimestamp| type| source ---|---|--- 2026-06-17 22:58:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg22moug2f 2026-06-22 09:58:44+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/116793168556043170 2026-06-23 09:02:19+00:00| seen|...