112030 matches found
CVE-2010-2451
creationtimestamp| type| source ---|---|--- 2026-06-19 15:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monmmqv54g2t...
MAL-2026-6218 Malicious code in chai-as-attested (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e27467366a90f482eb47476458b1f74d5a41ac63371572e527f2e60e4e0b51 Package impersonates a pino-style logger exports module.exports.pino, ships pino-like DEFAULTLEVELS, keywords fast/logger/stream/json but the exporte...
CVE-2026-39999
creationtimestamp| type| source ---|---|--- 2026-06-19 14:25:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3monkbmgnwz2z 2026-06-21 15:33:01+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mosoyvi5jr2z 2026-06-21 16:31:02+00:00| seen|...
GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...
GHSA-37PM-83G7-R22V canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Summary In affected versions, the OAuth2 token request sends appid, appsecret, refreshtoken and code as URL query parameters of the POST request to https://oauth./oauth/api/oauth2/token. Request URLs are commonly recorded in access logs, proxy logs and APM traces, so the application secret and...
CVE-2026-48931
creationtimestamp| type| source ---|---|--- 2026-06-19 13:45:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c 2026-06-21 19:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260622 2026-06-23 13:41:44+00:00| seen|...
CVE-2026-48934
creationtimestamp| type| source ---|---|--- 2026-06-19 13:45:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c 2026-06-21 19:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260622 2026-06-26 03:06:10+00:00| seen|...
CVE-2026-12706
creationtimestamp| type| source ---|---|--- 2026-06-19 12:29:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monds67tmg2k...
CVE-2026-6798
creationtimestamp| type| source ---|---|--- 2026-06-19 11:49:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monbll4lbt2k...
CVE-2015-0545
creationtimestamp| type| source ---|---|--- 2026-06-19 11:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3monav6j4ks2f...
GHSA-RWP6-7W3Q-75FQ
creationtimestamp| type| source ---|---|--- 2026-06-19 09:41:32+00:00| seen| https://gist.github.com/alon710/ce6be6956edb730f85105a449ccea809...
Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-27142 DESCRIPTION: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an...
CVE-2026-9822
creationtimestamp| type| source ---|---|--- 2026-06-19 07:49:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3momu5zpw4j2h...
CVE-2026-10735
creationtimestamp| type| source ---|---|--- 2026-06-19 07:16:13+00:00| seen| https://bsky.app/profile/ahmandonk.bsky.social/post/3momscoqoae2v 2026-07-13 13:00:07+00:00| seen| https://t.me/truesecator/8322 2026-07-14 00:00:43+00:00| exploited| https://t.me/truesecator/8322...
CVE-2026-4328
The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin using wpremoteget to fetch a user-supplied URL without validating that the URL does not point to internal or private network resources in th...
CVE-2026-54414 FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint /api/folder/uploadToSharedFolder.php, leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEXFILENAME, which permit...
CVE-2026-54414
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint /api/folder/uploadToSharedFolder.php, leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEXFILENAME, which permit...
EUVD-2026-37984
The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin using wpremoteget to fetch a user-supplied URL without validating that the URL does not point to internal or private network resources in th...