Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
MEDIUM
CVE-2026-113867 - thunderbird: thunderbird: Unauthorized actions via XMPP stanza injection
NEAR-REAL-TIME
CVE-2026-113867 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
MEDIUM
CVE-2026-113866 - thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
NEAR-REAL-TIME
CVE-2026-113866 · Red Hat - CVE Feed · published 2026-10-20T19:14
Red Hat
Source ↗
MEDIUM
CVE-2026-113714 - virtualenv: virtualenv: Unverified package installation via premature cache storage
NEAR-REAL-TIME
CVE-2026-113714 · Red Hat - CVE Feed · published 2026-10-20T19:09
Red Hat
Source ↗
MEDIUM
CVE-2026-113713 - virtualenv: virtualenv: Arbitrary code execution via insecure temporary cache symlinks
NEAR-REAL-TIME
CVE-2026-113713 · Red Hat - CVE Feed · published 2026-10-20T19:06
Red Hat
Source ↗
HIGH
GHSA-698v-4r3x-3vcv - launch-editor: escapeCmdArgs() omits % escaping on Windows
NEAR-REAL-TIME
CVE-2026-112943 · GitHub Security Advisories · published 2026-10-20T18:30 · correlated from 2 sources
launch-editorvitevite-plusRed Hat
Source ↗
HIGH
GHSA-22jm-h49p-29qw - MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
NEAR-REAL-TIME
CVE-2026-111767 · GitHub Security Advisories · published 2026-10-20T18:26
@modelcontextprotocol
Source ↗
MEDIUM
GHSA-6prh-2h8m-c8cw - MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
NEAR-REAL-TIME
CVE-2026-111769 · GitHub Security Advisories · published 2026-10-20T18:26
@modelcontextprotocol
Source ↗
MEDIUM
GHSA-xf6w-q65w-4f2w - ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
NEAR-REAL-TIME
CVE-2026-113653 · GitHub Security Advisories · published 2026-10-20T18:26
apostrophe
Source ↗
LOW
GHSA-vwwx-px9w-crrc - ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
NEAR-REAL-TIME
CVE-2026-113665 · GitHub Security Advisories · published 2026-10-20T18:25
apostrophe
Source ↗
MEDIUM
GHSA-97wv-p4xx-c7mg - ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
NEAR-REAL-TIME
CVE-2026-113664 · GitHub Security Advisories · published 2026-10-20T18:23
@apostrophecms
Source ↗
LOW
GHSA-gmfx-5g6x-rr72 - ApostropheCMS: Path traversal in uploadfs
NEAR-REAL-TIME
CVE-2026-113651 · GitHub Security Advisories · published 2026-10-20T18:21
uploadfs
Source ↗
LOW
GHSA-374f-7chj-9948 - ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
NEAR-REAL-TIME
CVE-2026-113657 · GitHub Security Advisories · published 2026-10-20T18:21 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
MEDIUM
GHSA-hhph-8536-gfq5 - ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
NEAR-REAL-TIME
CVE-2026-113652 · GitHub Security Advisories · published 2026-10-20T18:20
uploadfs
Source ↗
MEDIUM
GHSA-vmxh-77cw-65j7 - ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
NEAR-REAL-TIME
CVE-2026-113660 · GitHub Security Advisories · published 2026-10-20T18:19
apostrophe
Source ↗
MEDIUM
GHSA-jqw5-w6h3-44g6 - ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
NEAR-REAL-TIME
CVE-2026-113662 · GitHub Security Advisories · published 2026-10-20T18:19
@apostrophecms
Source ↗
MEDIUM
GHSA-m2m5-rw3w-cwmj - ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
NEAR-REAL-TIME
CVE-2026-113659 · GitHub Security Advisories · published 2026-10-20T18:18
apostrophe
Source ↗
MEDIUM
GHSA-653j-g8j7-gh54 - ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
NEAR-REAL-TIME
CVE-2026-113710 · GitHub Security Advisories · published 2026-10-20T18:17
apostrophe
Source ↗
MEDIUM
GHSA-cv27-6wvh-8x7j - ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
NEAR-REAL-TIME
CVE-2026-113661 · GitHub Security Advisories · published 2026-10-20T18:15 · correlated from 2 sources
sanitize-htmlRed Hat
Source ↗
MEDIUM
GHSA-gqh3-7856-rjjg - ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
NEAR-REAL-TIME
CVE-2026-113668 · GitHub Security Advisories · published 2026-10-20T18:14
apostrophe
Source ↗
MEDIUM
GHSA-2j32-q6rx-h844 - ApostropheCMS: Page REST API authorization bypass
NEAR-REAL-TIME
CVE-2026-113670 · GitHub Security Advisories · published 2026-10-20T18:13
apostrophe
Source ↗