CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid...

CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-48902

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:37+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48905

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:37+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48898

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q 2026-06-22 05:31:52+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mou5uunp2t2b...

CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's islocalurl function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to...

EUVD-2026-32527

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's islocalurl function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to...

CVE-2026-48927

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or views...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier is affected by a permission-check bypass in a form-validation method. The issue allows attackers with Overall/Read permissions to connect to an attacker-specified URL, enabling potential external requests from the plugin context. The affected component ...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2026-48906

creationtimestamp| type| source ---|---|--- 2026-05-27 13:43:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtna4mrm42c...

CVE-2026-45840

creationtimestamp| type| source ---|---|--- 2026-05-27 13:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtmvemvbk2i 2026-07-01 02:35:05+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630 2026-07-02 07:17:20+00:00| seen...

CVE-2026-48806

creationtimestamp| type| source ---|---|--- 2026-05-27 13:21:59+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmtlzlisnd23 2026-07-27 09:10:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkfue7cy2o 2026-07-27 09:10:43+00:00| seen|...

CVE-2026-45845

creationtimestamp| type| source ---|---|--- 2026-05-27 13:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtl56f3bo2c 2026-07-01 02:34:53+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630...

CVE-2026-42762

creationtimestamp| type| source ---|---|--- 2026-05-27 13:03:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtkxs5e2p2q 2026-06-23 05:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mownfu4myd2u...

CVE-2026-3349

The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-9689

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

CVE-2026-48760

creationtimestamp| type| source ---|---|--- 2026-05-27 10:04:06+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmtaxn3hnf2h 2026-05-27 14:35:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq4e3x7q2h...

CVE-2026-48489

creationtimestamp| type| source ---|---|--- 2026-05-27 10:03:46+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmtax4kuhm2m 2026-05-27 14:35:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq4e3x7q2h 2026-07-16 14:37:07+00:00| seen|...