net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-53261

creationtimestamp| type| source ---|---|--- 2026-06-25 09:53:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp45vwr3iz2a...

CVE-2026-53267

creationtimestamp| type| source ---|---|--- 2026-06-25 09:51:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp45sl4b4l2o 2026-06-25 19:59:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116812518218343282 2026-07-01 02:44:23+00:00| seen|...

CVE-2026-8705

creationtimestamp| type| source ---|---|--- 2026-06-25 08:16:31+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp3yi2o5x32x...

CVE-2026-12244

creationtimestamp| type| source ---|---|--- 2026-06-25 08:00:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3xkkigqf2x 2026-06-28 16:51:16+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mpegnart7x2e 2026-06-30 12:10:20+00:00| seen|...

Malicious code in subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04245cd013e6aa9edb766cf14249c9dd6abd19d6beb9671c22a1a8bbbff3d511 The package's main entry index.js is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfuscation that hides every liter...

CVE-2026-8662

creationtimestamp| type| source ---|---|--- 2026-06-25 06:26:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3sdcftjz2c...

CVE-2026-6292

creationtimestamp| type| source ---|---|--- 2026-06-25 06:16:17+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp3rr2wdgt2l...

Malicious code in logfmt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb22b2557674e7d616805d8a4086d69e02896be169b9e5d4d053eb3628ebe038 On npm install, scripts/install-check.cjs registered as a postinstall lifecycle script fetches a JSON config from a hardcoded anonymous Vercel app UR...

GHSA-M99R-2HXC-CP3Q

creationtimestamp| type| source ---|---|--- 2026-06-25 05:43:10+00:00| seen| https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40...

CVE-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...

CVE-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...

CVE-2026-9779

creationtimestamp| type| source ---|---|--- 2026-06-25 02:06:23+00:00| seen| https://bsky.app/profile/deafnews-auto.bsky.social/post/3mp3ds6lkch23...

CVE-2026-9785

creationtimestamp| type| source ---|---|--- 2026-06-25 01:34:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3bzdgdzn2x 2026-06-30 18:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpjlspnked2a...

CVE-2026-7570

creationtimestamp| type| source ---|---|--- 2026-06-25 01:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3bp7gze52t 2026-06-30 20:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpjsjcjla62v...

CVE-2026-7569

creationtimestamp| type| source ---|---|--- 2026-06-25 01:25:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3bjesd6v2s 2026-06-30 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpjqtn4b2y2a...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

GHSA-5GF7-WJFM-VMVM

creationtimestamp| type| source ---|---|--- 2026-06-25 00:01:29+00:00| seen| https://bsky.app/profile/slackers.it/post/3mp34su7fvx26...

PT-2026-52199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.3 through 18.11.5 GitLab CE/EE versions 19.0 through 19.0.2 GitLab CE/EE versions 19.1 through 19.1.0 Description Improper URL validation in mirror synchronization allows an authenticated user with maintainer-role...