CVE-2026-71294

creationtimestamp| type| source ---|---|--- 2026-08-05 14:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msdot46tz22p 2026-09-13 07:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102176 2026-09-14 00:00:30+00:00| published-proof-of-concept|...

GHSA-PWXH-7358-JQ2X

creationtimestamp| type| source ---|---|--- 2026-08-05 13:31:17+00:00| seen| https://gist.github.com/alon710/63aaf77a9f4550ada3647ec00940f1b7...

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

ROOT-APP-NPM-GHSA-J4MR-9XW3-C9JX GHSA-j4mr-9xw3-c9jx in base64-url - Patched by Root

Root has patched GHSA-j4mr-9xw3-c9jx in the base64-url package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

MAL-2026-12797 Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in technical-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data —...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Malicious code in alpha-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response...

CVE-2026-58074

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p...

CVE-2026-58075

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p...

CVE-2026-64630

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p...

CVE-2026-18809

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlptvmrx2l 2026-09-06 20:11:37+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3muushuymtk2n...

Malicious code in luluking2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array String.fromCharCode.apply on a numeric...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9 The package's postinstall hook runs setup.js, which enumerates process.env excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG, collect...