Malicious code in pathfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2527fa3618f01b694722f2a50297c248053dcdabf1b471ee9bdbdc6522bb838 pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an appended...

MAL-2026-5973 Malicious code in classbreeze-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19daf4f946816f5ba3c6e592eacc980861b281c6752b738de57fdd31f49279d The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typography...

CVE-2026-49050

creationtimestamp| type| source ---|---|--- 2026-06-17 02:58:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mohcxde75f2f...

CVE-2026-12464

creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 05:48:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohmhkfptc2f 2026-06-21 18:00:00+00:00| seen|...

CVE-2026-12452

creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 06:08:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohnlkqzrj22 2026-06-21 18:00:00+00:00| seen|...

CVE-2026-12462

creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 05:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohmwmbwsm2f 2026-06-21 18:00:00+00:00| seen|...

CVE-2026-12460

creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 06:00:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohn627uzo2j 2026-06-21 18:00:00+00:00| seen|...

CVE-2026-49073

creationtimestamp| type| source ---|---|--- 2026-06-17 01:00:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh4fdxvxf22...

GHSA-8GRP-WCQ9-925Q

creationtimestamp| type| source ---|---|--- 2026-06-17 00:41:42+00:00| seen| https://gist.github.com/alon710/244419ca59c137ef079d33a9b117602b...

CVE-2026-11410

creationtimestamp| type| source ---|---|--- 2026-06-17 00:40:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh3bjgwv222...

CVE-2026-49057

creationtimestamp| type| source ---|---|--- 2026-06-17 00:28:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh2k5rnnn2g 2026-06-22 21:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3movsnd7qvk2k...

CVE-2026-48783

creationtimestamp| type| source ---|---|--- 2026-06-17 00:11:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogznfyenc2x...

CVE-2026-8317

creationtimestamp| type| source ---|---|--- 2026-06-17 00:09:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogzjt5rpz2x...

CVE-2026-47277

creationtimestamp| type| source ---|---|--- 2026-06-17 00:07:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogzghhrvn2v...

CVE-2026-48781

creationtimestamp| type| source ---|---|--- 2026-06-17 00:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogz6imvsz26...

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and ACCESSEXTERNALSTYLESHEET="". Th...

PT-2026-50500

Name of the Vulnerable Software and Affected Versions Cisco Webex App affected versions not specified Description An issue in the browser-based version of the application allows an unauthenticated remote attacker to redirect users to a malicious webpage. This occurs due to improper input validati...

PT-2026-50609

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The Media module supports oEmbed, which utilizes two discovery mechanisms: providers.json and URL discovery. The URL discovery code can be exploited to trick the system into making...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...

PT-2026-50590

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The SafePlaywrightURLLoader uses a validate url function to prevent Server-Side Request Forgery SSRF by checking the IP address of a user-provided URL. However, this validation only occurs for the...