CVE-2026-11358

creationtimestamp| type| source ---|---|--- 2026-06-18 08:12:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokexoj37z2u...

CVE-2026-12098

creationtimestamp| type| source ---|---|--- 2026-06-18 08:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokeivjn7e2z...

CVE-2026-12093

creationtimestamp| type| source ---|---|--- 2026-06-18 07:57:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moke5d5js727...

CVE-2026-49759

creationtimestamp| type| source ---|---|--- 2026-06-18 07:07:36+00:00| seen| https://bsky.app/profile/cyberowi.pl/post/3mokbedhmti25...

CVE-2026-40783

creationtimestamp| type| source ---|---|--- 2026-06-18 05:07:51+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mok2knrcv52i...

Malicious code in stackus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a8032b910c8971e79e7d8b0e250ce4d61fd2a2206d6b319a5aed50e32490456 On require, lib/writer.js loaded transitively from the package's main pino.js collects the installer's full process.env together with host identifier...

Mattermost Desktop 5.13.x < 5.13.6 / 6.x < 6.2.0 Multiple Vulnerabilities (MMSA-2026-00651 / MMSA-2026-00652)

The version of Mattermost Desktop installed on the remote host is affected by multiple vulnerabilities: - Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a...

Siemens RUGGEDCOM RST2428P Cross-site Scripting (CVE-2025-66412)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting XSS vulnerability has been identified in the Angular Template Compiler. It occurs because the...

Siemens RUGGEDCOM RST2428P Cross-site Scripting (CVE-2026-22610)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting XSS vulnerability has been identified in the Angular Template Compiler. The...

PT-2026-50815

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15 Description An open redirect exists in the multi-factor authentication MFA flow. The MFA validate and register endpoints, specifically '/mfa/validate', process the user-supplied next query or form parameter...

CVE-2026-48768

TypeBot (versions ≤ 3.16.1) exposes an unauthenticated generate-upload-url API (/api/blocks/file-input/v3/generate-upload-url) that uses unsanitized fileName to derive public S3 keys and issues presigned PUT URLs that do not bind Content-Type. This allows anonymous users of a published bot with a...

CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...

CVE-2026-55202

creationtimestamp| type| source ---|---|--- 2026-06-17 23:01:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg7gts3g27 2026-08-02 15:23:25+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4c2epkfr2c...

CVE-2026-55200

creationtimestamp| type| source ---|---|--- 2026-06-17 22:58:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojg22moug2f 2026-06-22 09:58:44+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/116793168556043170 2026-06-23 09:02:19+00:00| seen|...

CVE-2026-10696

creationtimestamp| type| source ---|---|--- 2026-06-17 22:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojfqoeycz27...

MAL-2026-6088 Malicious code in vite-common-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d3397d754ffeb3726496769b2f159ce8596b2233b5875afa8f7fbca29ed0fd The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a element whose src is hardcoded to...

MAL-2026-6084 Malicious code in @array-util/nodepull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...

Malicious code in @array-util/nodepull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...

DRUPAL-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

CVE-2026-20246

creationtimestamp| type| source ---|---|--- 2026-06-17 18:50:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiy75gbak2f 2026-06-17 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1928...