Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
MEDIUM
GHSA-5324-3w58-qpp2 - Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
NEAR-REAL-TIME
CVE-2026-116575 · GitHub Security Advisories · published 2026-10-28T21:17 · correlated from 2 sources
mem0ai
Source ↗
HIGH
CVE-2026-118659 - Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Hap
NEAR-REAL-TIME
CVE-2026-118659 · NIST NVD - National Vulnerability Database · published 2026-10-28T21:16
Source ↗
HIGH
GHSA-vvm8-gf78-28g4 - Go JOSE: Panics in JSON parsing
NEAR-REAL-TIME
CVE-2026-116586 · GitHub Security Advisories · published 2026-10-28T21:14 · correlated from 3 sources
githubRed Hat
Source ↗
HIGH
GHSA-4w3g-jfj2-cw2q - Go JOSE: Panic during CBC-HMAC processing
NEAR-REAL-TIME
CVE-2026-116585 · GitHub Security Advisories · published 2026-10-28T21:14 · correlated from 3 sources
githubRed Hat
Source ↗
LOW
GHSA-4vjg-vx72-qq4g - systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
NEAR-REAL-TIME
CVE-2026-116673 · GitHub Security Advisories · published 2026-10-28T21:13 · correlated from 3 sources
systeminformationRed Hatlinux
Source ↗
MEDIUM
GHSA-7648-jmwf-vw7j - systeminformation has prototype pollution in `networkStats()` via the interface name
NEAR-REAL-TIME
CVE-2026-116674 · GitHub Security Advisories · published 2026-10-28T21:13 · correlated from 3 sources
systeminformationRed Hat
Source ↗
HIGH
CVE-2026-118752 - freeimage: FreeImage: Arbitrary code execution via heap-based buffer overflow in image decoder
NEAR-REAL-TIME
CVE-2026-118752 · Red Hat - CVE Feed · published 2026-10-28T21:11 · correlated from 2 sources
Red Hat
Source ↗
HIGH
CVE-2026-118694 - markdown2: markdown2: Denial of Service via unclosed inline link destinations
NEAR-REAL-TIME
CVE-2026-118694 · Red Hat - CVE Feed · published 2026-10-28T21:11 · correlated from 2 sources
Red Hat
Source ↗
LOW
GHSA-3cmx-xjww-583x - i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
NEAR-REAL-TIME
CVE-2026-118258 · GitHub Security Advisories · published 2026-10-28T21:10 · correlated from 3 sources
i18next-http-backendRed Hat
Source ↗
HIGH
GHSA-gg6h-894w-4m9c - RE2JS: Quadratic-time denial of service in re2js lookbehind matching
NEAR-REAL-TIME
CVE-2026-116795 · GitHub Security Advisories · published 2026-10-28T21:10 · correlated from 2 sources
re2js
Source ↗
HIGH
CVE-2026-118669 - oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers
NEAR-REAL-TIME
CVE-2026-118669 · Red Hat - CVE Feed · published 2026-10-28T21:09 · correlated from 3 sources
Red Hatoauthlib
Source ↗
HIGH
GHSA-4hm6-w6qq-w73v - LangGraph JavaScript custom authentication may permit cross-user Store access
NEAR-REAL-TIME
CVE-2026-118668 · GitHub Security Advisories · published 2026-10-28T21:09 · correlated from 2 sources
langgraph-api
Source ↗
MEDIUM
GHSA-6627-m3xw-93mp - filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
NEAR-REAL-TIME
CVE-2026-112908 · GitHub Security Advisories · published 2026-10-28T21:09
filelock
Source ↗
MEDIUM
GHSA-8mx5-7m5m-r77g - filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
NEAR-REAL-TIME
CVE-2026-112910 · GitHub Security Advisories · published 2026-10-28T21:08
filelock
Source ↗
MEDIUM
GHSA-m462-7rxw-wvpg - filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
NEAR-REAL-TIME
CVE-2026-112938 · GitHub Security Advisories · published 2026-10-28T21:08
filelock
Source ↗
MEDIUM
GHSA-ccrj-gw8r-854m - opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
NEAR-REAL-TIME
CVE-2026-118259 · GitHub Security Advisories · published 2026-10-28T21:07 · correlated from 2 sources
io.opentelemetry:opentelemetry-api
Source ↗
HIGH
GHSA-c8p4-j97h-3vg8 - Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
NEAR-REAL-TIME
CVE-2026-118660 · GitHub Security Advisories · published 2026-10-28T21:06 · correlated from 3 sources
happy-domRed Hat
Source ↗
MEDIUM
GHSA-8rc2-428q-7ww3 - Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
NEAR-REAL-TIME
CVE-2026-118256 · GitHub Security Advisories · published 2026-10-28T21:06 · correlated from 3 sources
vue-i18n@intlifypetite-vue-i18nRed Hat
Source ↗
HIGH
GHSA-83rm-6c8r-g728 - Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
NEAR-REAL-TIME
CVE-2026-118257 · GitHub Security Advisories · published 2026-10-28T21:06 · correlated from 3 sources
vue-i18npetite-vue-i18n@intlifyRed Hat
Source ↗
MEDIUM
GHSA-5fpq-26gf-qwcr - Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
NEAR-REAL-TIME
CVE-2026-118661 · GitHub Security Advisories · published 2026-10-28T21:06 · correlated from 3 sources
happy-domRed Hat
Source ↗