Automated cyber signal feeds.
CVE ID :CVE-2026-53500 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname…
CVE ID :CVE-2026-53501 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when…
CVE ID :CVE-2026-53502 Published : July 31, 2026, 7:17 p.m. | 36 minutes ago Description :Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through…
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted organizations operate…
CVE ID :CVE-2026-54729 Published : July 31, 2026, 6:17 p.m. | 1 hour, 36 minutes ago Description :DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as…
Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of…
CVE ID :CVE-2026-18245 Published : July 30, 2026, 6:13 p.m. | 32 minutes ago Description :Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD…
CVE ID :CVE-2026-12943 Published : July 30, 2026, 5:57 p.m. | 47 minutes ago Description :IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to…
CVE ID :CVE-2026-54722 Published : July 30, 2026, 5:16 p.m. | 1 hour, 28 minutes ago Description :DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src strips the…
CVE ID :CVE-2026-12940 Published : July 30, 2026, 5:16 p.m. | 1 hour, 28 minutes ago Description :IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher.…