112025 matches found
CVE-2026-49356
CVE-2026-49356 affects @babel/core (Babel) prior to versions 8.0.0-rc.6 and 7.29.6. The issue allows an arbitrary file read via a sourceMappingURL comment in the input code, enabling reading of source maps from the system running Babel when the attacker controls the input source code and knows th...
CVE-2026-49356 Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core
Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is...
CVE-2026-10601
creationtimestamp| type| source ---|---|--- 2026-06-22 16:04:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movb7dxt3y2g...
CVE-2026-5139
creationtimestamp| type| source ---|---|--- 2026-06-22 15:54:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movanaj4zd2t...
CVE-2026-42129
creationtimestamp| type| source ---|---|--- 2026-06-22 15:50:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3movahfyvmh2t...
CVE-2026-46417
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how...
CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints an...
CVE-2026-50168
CVE-2026-50168 affects Angular's @angular/platform-server and enables SSRF via a parser differential between the strict WHATWG URL parser (used for allowlists) and Domino’s lenient parser (used for server emulation). A malformed URL with a double-port structure (e.g., http://evil.com:80:80/path) ...
CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints an...
OPENSUSE-SU-2026:21016-1 Security update for mutt
This update for mutt fixes the following issues - CVE-2026-43859: strfcpy used instead of memcpy for the IMAP authcram MD5 digest bsc1263897. - CVE-2026-43860: truncation of hashpasswd by one byte for IMAP authcram MD5 digest bsc1263896. - CVE-2026-43861: missing check for \0 in urlpctdecode...
EUVD-2026-38287
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls...
CVE-2026-9610
IBM Datacap (including Datacap Navigator) 9.1.7–9.1.9 exposes resources or functionality not linked in the UI but accessible via direct URL requests, bypassing access controls (CWE-425: Direct Request). Affected: IBM Datacap 9.1.7, 9.1.8, 9.1.9 and Datacap Navigator 9.1.7, 9.1.8, 9.1.9. IBM’s bul...
CVE-2026-12863
creationtimestamp| type| source ---|---|--- 2026-06-22 12:37:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mouvnnghge2r...
CVE-2026-12580
creationtimestamp| type| source ---|---|--- 2026-06-22 12:17:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mouujtdzm622...
SUSE-SU-2026:2487-1 Security update for rmt-server
This update for rmt-server fixes the following issues - CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content bsc1261398. - CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting bsc1261471. -...
MAL-2026-6307 Malicious code in @glitchpad/throttler (npm)
@glitchpad/throttler malicious version 2.2.3, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern...
CVE-2026-10530
creationtimestamp| type| source ---|---|--- 2026-06-22 07:59:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moug4p7kfu2r...
CVE-2026-12804
A flaw was found in lemonldap-ng. A remote attacker could exploit this vulnerability by manipulating the 'url' argument within the SAML Common Domain Cookie Endpoint. This manipulation results in an open redirect, potentially leading to users being redirected to arbitrary malicious websites...