110218 matches found
CVE-2026-0276
creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:30+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sow2ip32c 2026-07-10 00:15:07+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0276...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the safeurl process. An attacker can inject malicious URLs into rendered href and src attributes by crafting links that use legacy or chained schemes, potentially leading to script execution in affected user...
CVE-2026-59703
creationtimestamp| type| source ---|---|--- 2026-07-08 18:02:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pbiipf427...
Malicious code in crypto-promiser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88 [email protected] is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall...
CVE-2026-15067
creationtimestamp| type| source ---|---|--- 2026-07-08 17:30:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nict4ia2k...
DEBIAN-CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-59923
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
PYSEC-2026-2211
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-55075
creationtimestamp| type| source ---|---|--- 2026-07-08 17:07:39+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq5m7qsymz26...
MAL-2026-6999 Malicious code in luludawang-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...
CVE-2026-49145
creationtimestamp| type| source ---|---|--- 2026-07-08 16:30:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5k5n2qyc24...
CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...
CVE-2026-6740
creationtimestamp| type| source ---|---|--- 2026-07-08 16:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq5jdlqkpu22...
CVE-2026-0288
creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:21+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116885246523577101 2026-07-08 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soxii4n22 2026-07-08 20:15:02+00:00| seen|...
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59923
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59923
CVE-2026-59923 affects Mistune, a Python Markdown parser. Before 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. The issue is fixed in version 3.3.0. E...
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...