Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
MEDIUM
GHSA-8g5g-mxqh-grgj - Vite: `server.fs.deny` bypassed with queries
NEAR-REAL-TIME
CVE-2026-118662 · GitHub Security Advisories · published 2026-10-29T16:39 · correlated from 2 sources
vite
Source ↗
HIGH
GHSA-6j52-38f8-qhxr - Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
NEAR-REAL-TIME
CVE-2026-63414 · GitHub Security Advisories · published 2026-10-29T16:39 · correlated from 2 sources
shopify_app
Source ↗
HIGH
GHSA-8rvj-mm4h-c258 - cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
NEAR-REAL-TIME
CVE-2026-62290 · GitHub Security Advisories · published 2026-10-29T16:39
github
Source ↗
HIGH
GHSA-v3f7-2p4r-mwfw - Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
NEAR-REAL-TIME
CVE-2026-9086 · GitHub Security Advisories · published 2026-10-29T16:39
org.keycloak:keycloak-services
Source ↗
MEDIUM
GHSA-9jrw-8xf7-xqhq - Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
NEAR-REAL-TIME
CVE-2026-9083 · GitHub Security Advisories · published 2026-10-29T16:38
org.keycloak:keycloak-services
Source ↗
MEDIUM
GHSA-w3p3-7cjg-vgfw - Keycloak allows unauthorized access to resources via uma permission ticket bypass
NEAR-REAL-TIME
CVE-2026-9799 · GitHub Security Advisories · published 2026-10-29T16:37
org.keycloak:keycloak-services
Source ↗
HIGH
GHSA-f5p5-6xmx-p252 - Keycloak vulnerable to authorization bypass via incorrect uri comparison
NEAR-REAL-TIME
CVE-2026-9800 · GitHub Security Advisories · published 2026-10-29T16:37
org.keycloak:keycloak-servicesorg.keycloak:keycloak-policy-enforcer
Source ↗
MEDIUM
GHSA-r7rc-c989-86g6 - Keycloak: Attacker can re-enable and take over disabled clients via registration access token
NEAR-REAL-TIME
CVE-2026-9705 · GitHub Security Advisories · published 2026-10-29T16:36
org.keycloak:keycloak-services
Source ↗
HIGH
GHSA-w9x9-j56r-h98r - @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-29T16:35
@eeacms
Source ↗
MEDIUM
GHSA-8vfg-2r28-hvhj - Crass: Non-ASCII characters cause superlinear CPU consumption
NEAR-REAL-TIME
CVE-2026-61848 · GitHub Security Advisories · published 2026-10-29T16:35 · correlated from 3 sources
crassRed Hat
Source ↗
HIGH
GHSA-wwpr-jff3-395c - Crass: A large number of adjacent CSS comments can trigger a SystemStackError
NEAR-REAL-TIME
CVE-2026-61847 · GitHub Security Advisories · published 2026-10-29T16:35 · correlated from 3 sources
crassRed Hat
Source ↗
MEDIUM
GHSA-6jxj-px6v-747w - Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
NEAR-REAL-TIME
CVE-2026-61846 · GitHub Security Advisories · published 2026-10-29T16:35 · correlated from 3 sources
crassRed Hat
Source ↗
LOW
GHSA-c33x-vcv4-vg3g - Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-29T16:35
cedar-policy@cedar-policy
Source ↗
HIGH
GHSA-q344-5v34-gm84 - @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
NEAR-REAL-TIME
CVE-2026-62264 · GitHub Security Advisories · published 2026-10-29T16:34 · correlated from 2 sources
@sylphx
Source ↗
HIGH
GHSA-26mh-57q7-jfvr - PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
NEAR-REAL-TIME
CVE-2026-61438 · GitHub Security Advisories · published 2026-10-29T16:34
praisonai
Source ↗
LOW
GHSA-r899-h629-j84r - Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
NEAR-REAL-TIME
CVE-2026-61448 · GitHub Security Advisories · published 2026-10-29T16:33
parse-server
Source ↗
HIGH
GHSA-rhj7-vh3v-mcq6 - Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
NEAR-REAL-TIME
CVE-2026-62160 · GitHub Security Advisories · published 2026-10-29T16:33 · correlated from 2 sources
github
Source ↗
LOW
GHSA-pg53-p7qp-65cv - PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-29T16:32
pocketmine
Source ↗
MEDIUM
GHSA-68wq-phq7-p2vg - MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
NEAR-REAL-TIME
CVE-2026-55186 · GitHub Security Advisories · published 2026-10-29T16:32 · correlated from 2 sources
silverstripe
Source ↗
HIGH
CVE-2026-96203 - Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
NEAR-REAL-TIME
CVE-2026-96203 · NIST NVD - National Vulnerability Database · published 2026-10-29T16:20
microsoft
Source ↗