Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
CRITICAL
GHSA-6q48-6c7w-9gw2 - certifi bundles emSign root CAs with compromised intermediate CA keys
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-20T19:35
certifi
Source ↗
MEDIUM
CVE-2026-113717 - virtualenv: virtualenv: Integrity verification bypass via pip seeder download option
NEAR-REAL-TIME
CVE-2026-113717 · Red Hat - CVE Feed · published 2026-10-20T19:22
Red Hat
Source ↗
MEDIUM
CVE-2026-113716 - virtualenv: virtualenv: Unauthorized file write via symlink following
NEAR-REAL-TIME
CVE-2026-113716 · Red Hat - CVE Feed · published 2026-10-20T19:18 · correlated from 2 sources
Red Hatvirtualenv
Source ↗
MEDIUM
CVE-2026-113868 - thunderbird: Thunderbird: information disclosure via malformed authentication challenge
NEAR-REAL-TIME
CVE-2026-113868 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
HIGH
CVE-2026-113869 - thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt
NEAR-REAL-TIME
CVE-2026-113869 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
MEDIUM
CVE-2026-113867 - thunderbird: thunderbird: Unauthorized actions via XMPP stanza injection
NEAR-REAL-TIME
CVE-2026-113867 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
MEDIUM
CVE-2026-113866 - thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
NEAR-REAL-TIME
CVE-2026-113866 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
MEDIUM
CVE-2026-113714 - virtualenv: virtualenv: Unverified package installation via premature cache storage
NEAR-REAL-TIME
CVE-2026-113714 · Red Hat - CVE Feed · published 2026-10-20T19:09
Red Hat
Source ↗
MEDIUM
CVE-2026-113713 - virtualenv: virtualenv: Arbitrary code execution via insecure temporary cache symlinks
NEAR-REAL-TIME
CVE-2026-113713 · Red Hat - CVE Feed · published 2026-10-20T19:06
Red Hat
Source ↗
HIGH
GHSA-698v-4r3x-3vcv - launch-editor: escapeCmdArgs() omits % escaping on Windows
NEAR-REAL-TIME
CVE-2026-112943 · GitHub Security Advisories · published 2026-10-20T18:30 · correlated from 2 sources
launch-editorvitevite-plusRed Hat
Source ↗
HIGH
GHSA-22jm-h49p-29qw - MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
NEAR-REAL-TIME
CVE-2026-111767 · GitHub Security Advisories · published 2026-10-20T18:26 · correlated from 2 sources
@modelcontextprotocolRed Hat
Source ↗
MEDIUM
GHSA-6prh-2h8m-c8cw - MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
NEAR-REAL-TIME
CVE-2026-111769 · GitHub Security Advisories · published 2026-10-20T18:26
@modelcontextprotocol
Source ↗
MEDIUM
GHSA-xf6w-q65w-4f2w - ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
NEAR-REAL-TIME
CVE-2026-113653 · GitHub Security Advisories · published 2026-10-20T18:26
apostrophe
Source ↗
LOW
GHSA-vwwx-px9w-crrc - ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
NEAR-REAL-TIME
CVE-2026-113665 · GitHub Security Advisories · published 2026-10-20T18:25
apostrophe
Source ↗
MEDIUM
GHSA-97wv-p4xx-c7mg - ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
NEAR-REAL-TIME
CVE-2026-113664 · GitHub Security Advisories · published 2026-10-20T18:23
@apostrophecms
Source ↗
LOW
GHSA-gmfx-5g6x-rr72 - ApostropheCMS: Path traversal in uploadfs
NEAR-REAL-TIME
CVE-2026-113651 · GitHub Security Advisories · published 2026-10-20T18:21
uploadfs
Source ↗
LOW
GHSA-374f-7chj-9948 - ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
NEAR-REAL-TIME
CVE-2026-113657 · GitHub Security Advisories · published 2026-10-20T18:21 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
MEDIUM
GHSA-hhph-8536-gfq5 - ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
NEAR-REAL-TIME
CVE-2026-113652 · GitHub Security Advisories · published 2026-10-20T18:20
uploadfs
Source ↗
MEDIUM
GHSA-vmxh-77cw-65j7 - ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
NEAR-REAL-TIME
CVE-2026-113660 · GitHub Security Advisories · published 2026-10-20T18:19
apostrophe
Source ↗
MEDIUM
GHSA-jqw5-w6h3-44g6 - ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
NEAR-REAL-TIME
CVE-2026-113662 · GitHub Security Advisories · published 2026-10-20T18:19
@apostrophecms
Source ↗