CVE-2026-30905

creationtimestamp| type| source ---|---|--- 2026-05-12 15:28:54+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlo44fuhc423...

CVE-2026-35071

creationtimestamp| type| source ---|---|--- 2026-05-12 15:20:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlo3nmgh462n...

CVE-2026-30635

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the viewtask aka view in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGEBASEURL...

CVE-2026-45284

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45157

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45159

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45154

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45155

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-42260 Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF wit...

CVE-2026-42742

creationtimestamp| type| source ---|---|--- 2026-05-12 11:55:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnq7hqbk62k...

CVE-2026-7562

creationtimestamp| type| source ---|---|--- 2026-05-12 10:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlnllre5gp2c...

CVE-2026-7561

creationtimestamp| type| source ---|---|--- 2026-05-12 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlniahwve42x...

CVE-2026-38568

creationtimestamp| type| source ---|---|--- 2026-05-12 09:25:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnhrjjywa2e...

CVE-2026-1681

creationtimestamp| type| source ---|---|--- 2026-05-12 09:09:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlngwl2gxq2o...

CVE-2026-44694

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client N8NAPIURL, a...

CVE-2026-7626 Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...

Malicious code in @chahuadev/junk-sweeper-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51 The package's postinstall script package.json line 10: "postinstall": "node install.js" unconditionally fetches a platform-native executable from...

Malicious code in dcchbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79831d1b486c8ca704295b410cec7b66be85aa87c3244d97ff1e87f643183a The package performs multiple installer-hostile behaviors. 1 dcchbot/init.py auto-invokes run on import, which triggers interactive input prompts and...

CVE-2026-40133

creationtimestamp| type| source ---|---|--- 2026-05-12 05:12:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmzol4bqz2i 2026-05-12 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:07+00:00| seen|...

CVE-2026-40136

creationtimestamp| type| source ---|---|--- 2026-05-12 04:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmyt54c6l2p 2026-05-12 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:07+00:00| seen|...