CVE-2026-49145

creationtimestamp| type| source ---|---|--- 2026-07-08 16:30:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5k5n2qyc24...

CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safeurl filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:...

CVE-2026-6740

creationtimestamp| type| source ---|---|--- 2026-07-08 16:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq5jdlqkpu22...

CVE-2026-0288

creationtimestamp| type| source ---|---|--- 2026-07-08 16:15:21+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116885246523577101 2026-07-08 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soxii4n22 2026-07-08 20:15:02+00:00| seen|...

CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-59923

CVE-2026-59923 affects Mistune, a Python Markdown parser. Before 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. The issue is fixed in version 3.3.0. E...

CVE-2026-59923

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...

CVE-2026-56776

creationtimestamp| type| source ---|---|--- 2026-07-08 16:09:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5iyjp3my2w...

CVE-2018-20598

creationtimestamp| type| source ---|---|--- 2026-07-08 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5itiwowm2f...

CVE-2026-56778

creationtimestamp| type| source ---|---|--- 2026-07-08 15:53:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5i3z3kwf2q...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2024-30326

creationtimestamp| type| source ---|---|--- 2026-07-08 15:42:47+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116885118437929306...

CVE-2026-54423

creationtimestamp| type| source ---|---|--- 2026-07-08 15:30:34+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5gs5iuht24 2026-07-10 05:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbeizh3yj2c 2026-07-10 05:41:51+00:00| seen|...

CVE-2026-24698

creationtimestamp| type| source ---|---|--- 2026-07-08 15:20:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116885031205203938 2026-07-08 18:07:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pkgwrsc26...

CVE-2026-14967

BBOT’s github_workflows module has a path-traversal vulnerability: the path-containment check fails to resolve ‘..’, allowing a crafted CODE_REPOSITORY URL to traverse out of the configured output directory. The write is bounded to two directory levels above the output location and the target is ...

CVE-2026-59703

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file://...

CVE-2026-59703 repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file://...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the testConnection API when a malicious H2 JDBC URL is supplied, which leverages the H2 INIT parameter. An attacker can execute arbitrary Java code on the server by sending a crafted request to the API...