110218 matches found
Malicious code in fury_frontend-andes-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37 The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username os.userInfo, current working...
CVE-2026-54005
creationtimestamp| type| source ---|---|--- 2026-07-09 20:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqai4jjnxs24...
CVE-2026-13492
creationtimestamp| type| source ---|---|--- 2026-07-09 20:21:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahj5jc7c2x 2026-07-10 00:00:29+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqatqugq6z23...
CVE-2026-54002
creationtimestamp| type| source ---|---|--- 2026-07-09 20:11:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqagxaj5e62x...
CVE-2026-14904
creationtimestamp| type| source ---|---|--- 2026-07-09 20:03:40+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mqagjdixno2e...
CVE-2026-49274
creationtimestamp| type| source ---|---|--- 2026-07-09 19:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqag5munyo2x...
CVE-2026-58459
creationtimestamp| type| source ---|---|--- 2026-07-09 19:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqadagsstr26 2026-07-13 18:29:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd43obcc2x 2026-07-14 21:37:07+00:00| seen|...
CVE-2026-59826
creationtimestamp| type| source ---|---|--- 2026-07-09 18:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqab6hpfet2r 2026-07-09 18:43:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqabz6y7ax27 2026-07-16 14:04:29+00:00| seen|...
CVE-2026-59721
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...
CVE-2026-15202
CVE-2026-15202 affects YzmCMS up to version 7.5. The vulnerability resides in the get_url function of /yzmphp/yzmphp.php within the Header Handler, where manipulation of the HTTP_HOST argument enables cross-site scripting. Exploitation is remote and publicly disclosed. Vendor contact did not elic...
CVE-2026-15202 YzmCMS Header yzmphp.php get_url cross site scripting
A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function geturl of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTPHOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
EUVD-2026-42653
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...
CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...
CVE-2026-59721
Hoppscotch (open source API development ecosystem) contains a Rooted Command Execution risk before version 2026.6.0 due to the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepting an attacker-controlled MAILER_SMTP_URL. The validateSMTPUrl in utils.ts permits path, query, or f...
CVE-2026-51602
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 firmware V31.1.9.91 allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL fiel...
GHSA-387M-935M-C4VW
creationtimestamp| type| source ---|---|--- 2026-07-09 17:11:45+00:00| seen| https://gist.github.com/alon710/4972c27e69247db8e70c7471b199efc4...
SUSE-SU-2026:2817-1 Security update for go1.25
This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta content...
PYSEC-2026-2683 Open Redirect vulnerability in jupyterhub and notebook
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers Chrome, Firefox in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a baseurl prefix are not affecte...
CVE-2026-54799
creationtimestamp| type| source ---|---|--- 2026-07-09 16:42:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqa3brethk24 2026-07-10 14:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccogp5db24 2026-07-16 16:15:05+00:00| seen|...