Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
MEDIUM
GHSA-3fx2-cqw9-xr3c - LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
NEAR-REAL-TIME
CVE-2026-118667 · GitHub Security Advisories · published 2026-10-28T21:05 · correlated from 3 sources
langgraph-sdklanggraphRed Hat
Source ↗
HIGH
GHSA-434m-5hcj-pxf3 - GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
NEAR-REAL-TIME
CVE-2026-118665 · GitHub Security Advisories · published 2026-10-28T21:05 · correlated from 2 sources
@graphql-tools
Source ↗
MEDIUM
GHSA-mp66-8ww2-pcwm - GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
NEAR-REAL-TIME
CVE-2026-118666 · GitHub Security Advisories · published 2026-10-28T21:05 · correlated from 2 sources
@graphql-tools
Source ↗
MEDIUM
GHSA-rmxm-3fg6-px4f - @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
NEAR-REAL-TIME
CVE-2026-118663 · GitHub Security Advisories · published 2026-10-28T21:05 · correlated from 2 sources
@hono
Source ↗
MEDIUM
GHSA-2ffq-g2xg-c22p - Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
NEAR-REAL-TIME
CVE-2026-118657 · GitHub Security Advisories · published 2026-10-28T21:04 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-3pmx-cf9f-34xr - Echo static file middleware route protection bypass via encoded dot-dot traversal
NEAR-REAL-TIME
CVE-2026-118654 · GitHub Security Advisories · published 2026-10-28T21:04 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-xwq5-6cqp-vx96 - Echo has a Static Middleware Double-Unescape Path Traversal
NEAR-REAL-TIME
CVE-2026-118655 · GitHub Security Advisories · published 2026-10-28T21:04 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-v753-g4cw-jm48 - Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI
NEAR-REAL-TIME
CVE-2026-118656 · GitHub Security Advisories · published 2026-10-28T21:04 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-23wf-92cp-8pcj - Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
NEAR-REAL-TIME
CVE-2026-118658 · GitHub Security Advisories · published 2026-10-28T21:04 · correlated from 2 sources
github
Source ↗
MEDIUM
CVE-2026-118947 - keycloak-services: keycloak-services: Authorization bypass via UMA resource registration IDOR
NEAR-REAL-TIME
CVE-2026-118947 · Red Hat - CVE Feed · published 2026-10-28T20:58 · correlated from 2 sources
Red Hat
Source ↗
HIGH
CVE-2026-78674 - The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted
NEAR-REAL-TIME
CVE-2026-78674 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:18
Source ↗
HIGH
CVE-2026-6647 - In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for i
NEAR-REAL-TIME
CVE-2026-6647 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:18
Source ↗
CRITICAL
CVE-2026-63190 - FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f
NEAR-REAL-TIME
CVE-2026-63190 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:18
Source ↗
HIGH
CVE-2026-61542 - Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem,
NEAR-REAL-TIME
CVE-2026-61542 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:18
Source ↗
MEDIUM
CVE-2026-61529 - Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /f
NEAR-REAL-TIME
CVE-2026-61529 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:18
Source ↗
LOW
CVE-2026-3583 - When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invali
NEAR-REAL-TIME
CVE-2026-3583 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:17
Source ↗
MEDIUM
CVE-2026-11854 - The authentication endpoint generates an error message that includes reflected data directly from the request without su
NEAR-REAL-TIME
CVE-2026-11854 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:17
Source ↗
MEDIUM
CVE-2026-115415 - Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 mig
NEAR-REAL-TIME
CVE-2026-115415 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:17
Source ↗
HIGH
CVE-2025-14260 - Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to reso
NEAR-REAL-TIME
CVE-2025-14260 · NIST NVD - National Vulnerability Database · published 2026-10-28T20:17
Source ↗
HIGH
GHSA-6hgp-fmhr-mrg4 - Highcharts Grid: `javascript:` URL in credits.href runs script on click
NEAR-REAL-TIME
CVE-2026-118255 · GitHub Security Advisories · published 2026-10-28T19:57 · correlated from 2 sources
@highcharts
Source ↗