CVE-2026-42659

creationtimestamp| type| source ---|---|--- 2026-05-18 11:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm4rqkm3rc2h...

CLSA-2026-1779096552 Fix CVE(s): CVE-2025-13836, CVE-2026-4519

SECURITY UPDATE: memory denial of service via attacker-controlled Content-Length in http.client - debian/patches/CVE-2025-13836.patch: rewrite Lib/http/client.py saferead to read large responses in geometrically-growing chunks bounded by MINREADBUFSIZE 1 MiB, preventing OOM when a malicious serve...

CVE-2026-6478

creationtimestamp| type| source ---|---|--- 2026-05-18 09:02:04+00:00| seen| https://bsky.app/profile/PostgreSQL.activitypub.awakari.com.ap.brid.gy/post/3mm4j4wewdng2 2026-06-05 14:33:15+00:00| seen| https://bsky.app/profile/pgexperts.bsky.social/post/3mnke6ysiwm2c 2026-06-23 19:16:28+00:00| seen...

CVE-2026-4273

creationtimestamp| type| source ---|---|--- 2026-05-18 08:59:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4j5attsm2h...

CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-3471

Mattermost Desktop App shows a vulnerability in versions ≤6.1, 6.0.1, 5.4.13.0 where it does not sanitize an invalid URL in a pop‑up window, enabling a malicious server to repeatedly crash the application via window.open('javascript:alert()'). Root cause: improper handling of URLs in pop‑ups. Imp...

CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-3471

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-6340

creationtimestamp| type| source ---|---|--- 2026-05-18 08:32:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hmztahz2c...

CVE-2026-8788

creationtimestamp| type| source ---|---|--- 2026-05-18 07:23:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm4drwo3u62g 2026-05-18 08:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hfltxds2i...

CVE-2026-8785

creationtimestamp| type| source ---|---|--- 2026-05-18 06:37:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4b7i5vqd2h 2026-05-18 06:52:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mm4c3nhqcd2w...

CVE-2026-8781

creationtimestamp| type| source ---|---|--- 2026-05-18 06:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4awjn5ds2h...

CVE-2026-8783

creationtimestamp| type| source ---|---|--- 2026-05-18 06:22:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4aemodku2k...

CVE-2026-8780

creationtimestamp| type| source ---|---|--- 2026-05-18 06:12:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm47spmjgs2p...

CVE-2026-8782

creationtimestamp| type| source ---|---|--- 2026-05-18 06:08:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm47kzzxps2c...

CVE-2026-42658

creationtimestamp| type| source ---|---|--- 2026-05-18 05:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm45mtbgnj2s...

CVE-2026-8779

creationtimestamp| type| source ---|---|--- 2026-05-18 03:21:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3wc4icy32v...

CVE-2026-8777

creationtimestamp| type| source ---|---|--- 2026-05-18 03:16:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3vz5zlvx2p...

CVE-2026-8774

creationtimestamp| type| source ---|---|--- 2026-05-18 02:52:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3unooxqv2p...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation called before applying validateDownloadUrl follows redirects by default...