Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
HIGH
CVE-2026-115935 - The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel
NEAR-REAL-TIME
CVE-2026-115935 · NIST NVD - National Vulnerability Database · published 2026-10-23T22:16
Source ↗
CRITICAL
CVE-2026-115893 - Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 c
NEAR-REAL-TIME
CVE-2026-115893 · NIST NVD - National Vulnerability Database · published 2026-10-23T22:16
Source ↗
HIGH
CVE-2026-115887 - GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until
NEAR-REAL-TIME
CVE-2026-115887 · NIST NVD - National Vulnerability Database · published 2026-10-23T22:16
Source ↗
INFORMATIONAL
CVE-2026-115885 - The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --ver
NEAR-REAL-TIME
CVE-2026-115885 · NIST NVD - National Vulnerability Database · published 2026-10-23T22:16
Source ↗
MEDIUM
CVE-2026-115801 - A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::
NEAR-REAL-TIME
CVE-2026-115801 · NIST NVD - National Vulnerability Database · published 2026-10-23T22:16
Source ↗
MEDIUM
GHSA-m5mm-p8h7-m29v - Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
NEAR-REAL-TIME
CVE-2026-115897 · GitHub Security Advisories · published 2026-10-23T22:09 · correlated from 3 sources
serialize-javascriptRed Hat
Source ↗
MEDIUM
GHSA-2wqp-q3c6-ccj5 - MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
NEAR-REAL-TIME
CVE-2026-115886 · GitHub Security Advisories · published 2026-10-23T22:07 · correlated from 3 sources
mlflowRed Hat
Source ↗
MEDIUM
GHSA-6hmw-9432-67qq - LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
NEAR-REAL-TIME
CVE-2026-115883 · GitHub Security Advisories · published 2026-10-23T22:06 · correlated from 2 sources
langgraph-checkpoint-postgreslanggraph-checkpoint-sqlite
Source ↗
HIGH
GHSA-834v-8h66-3h79 - Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
NEAR-REAL-TIME
CVE-2026-115895 · GitHub Security Advisories · published 2026-10-23T22:06 · correlated from 3 sources
happy-domRed Hat
Source ↗
MEDIUM
GHSA-9pvw-hwfg-92h5 - Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
NEAR-REAL-TIME
CVE-2026-115892 · GitHub Security Advisories · published 2026-10-23T22:04 · correlated from 3 sources
wasmtimeRed Hat
Source ↗
CRITICAL
GHSA-897f-g5gm-fmxm - Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
NEAR-REAL-TIME
CVE-2026-115889 · GitHub Security Advisories · published 2026-10-23T22:02 · correlated from 2 sources
wasmtime
Source ↗
LOW
GHSA-h4fr-cmh5-qr62 - Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:58
fallow@fallow-clifallow-clifallow-configfallow-core
Source ↗
LOW
GHSA-jfwm-3p3c-6hx5 - Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
NEAR-REAL-TIME
CVE-2026-115569 · GitHub Security Advisories · published 2026-10-23T21:57 · correlated from 2 sources
fallow@fallow-clifallow-clifallow-core
Source ↗
HIGH
GHSA-f2hq-32vh-53cc - postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:54
postal-mime
Source ↗
MEDIUM
GHSA-8c8m-p3m8-cjg8 - Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:53
nodemailer
Source ↗
MEDIUM
GHSA-m943-m63m-w62w - Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:51
nodemailer
Source ↗
MEDIUM
GHSA-85x2-q946-cp5h - Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:51
nodemailer
Source ↗
CRITICAL
GHSA-f9x3-7vq9-cph6 - Laravel TokenGuard authentication bypass through non-string API credentials
NEAR-REAL-TIME
CVE-2026-114509 · GitHub Security Advisories · published 2026-10-23T21:50 · correlated from 2 sources
laravel
Source ↗
MEDIUM
GHSA-5wcm-3v2w-8362 - Laravel relationship inclusion can trigger unauthorized data destruction
NEAR-REAL-TIME
CVE-2026-114508 · GitHub Security Advisories · published 2026-10-23T21:47 · correlated from 2 sources
laravel
Source ↗
LOW
GHSA-xmj3-9gf7-h52w - setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-23T21:44
setuptools
Source ↗