# VulnSea

> Newly released CVE and 0day intelligence across every platform. Each entry is a structured markdown document with YAML frontmatter (id, severity, CVSS, affected/patched versions, references) followed by full technical detail.

Conventions for agents:
- Each CVE has raw markdown at https://beta.vulnsea.com/cve/<CVE-ID>.md
- Structured JSON at https://beta.vulnsea.com/api/cve/<CVE-ID>
- Query the feed at https://beta.vulnsea.com/api/cve?q=&severity=&vendor=&exploited=&depth=&limit=
- Compact triage digest at https://beta.vulnsea.com/api/digest (format=json|text|ndjson)
- Typo-tolerant search at https://beta.vulnsea.com/api/search?q=
- Related CVEs at https://beta.vulnsea.com/api/cve/<CVE-ID>/related — shared product/vendor/CWE/advisory, scored
- Dependency triage: POST https://beta.vulnsea.com/api/sbom { components:[ "pkg:npm/lodash@4.17.20", … ] } — affected CVEs per component, ranked by depth (anon = public window; key = full corpus)
- OSV-compatible: POST https://beta.vulnsea.com/api/osv/v1/query and /api/osv/v1/querybatch speak the osv.dev schema — existing OSV clients work unchanged; VulnSea signal under database_specific
- Resolve any identifier (GHSA-… or alias) to its canonical record: https://beta.vulnsea.com/api/resolve?id=
- Change feed at https://beta.vulnsea.com/api/changes?after=<seq> — per-CVE field-change events (kev added, severity bumped, epss moved) with an exact cursor; the re-triage trigger
- EPSS movers at https://beta.vulnsea.com/api/movers — biggest exploit-probability climbers over a window
- RSS feed at https://beta.vulnsea.com/feed.xml
- OpenAPI 3.1 spec at https://beta.vulnsea.com/openapi.json
- MCP server (JSON-RPC over Streamable HTTP) at https://beta.vulnsea.com/api/mcp — tools: list_cves, search_cve, get_cve, batch_get_cve, triage_sbom, related_cve, changes_since, resolve_id, get_epss_movers, get_stats

Incremental polling (for agents watching for new additions):
- https://beta.vulnsea.com/api/cve?since=<ISO-or-epoch-ms>&order=asc — records ingested after a timestamp
- Page with the `next` cursor in each response until it is null.
- Track the max `ingestedAt` you have seen; pass it as `since` next poll.
- Send `If-None-Match: <etag>` to get 304 Not Modified when nothing changed.
- `ingestedAt` = when VulnSea added the record (use this, not `published`, for deltas).
- Cheap check before fetching: HEAD https://beta.vulnsea.com/api/cve (or ?probe=1) returns only
  the corpus size + newest ingest timestamp (x-total-count / x-max-ingested-at).

Cost controls (fewer tokens / round-trips):
- `&fields=id,severity,depth,cvss` — sparse fieldset; returns only the named fields.
- https://beta.vulnsea.com/api/cve?ids=CVE-2021-44228,CVE-2014-0160 — batch fetch a known set (max 200) in one request.
- `/api/digest?format=ndjson` — one compact line per CVE for cheap scanning.

Field semantics:
- `severity` is one of: critical, high, medium, low.
- `exploited: true` means known exploited in the wild.
- `kev: true` means listed in the CISA Known Exploited Vulnerabilities catalog.
- `epss` is the FIRST.org exploit-prediction probability (0..1, 30-day window).
- `depth` is a composite triage zone = severity + exploitation signal, one of (shallow→deep) sunlit, twilight, midnight, abyssal, hadal. Deeper = graver and more proven: abyssal = critical with a public exploit / in-the-wild use; hadal = critical and actively exploited (CISA KEV / 0day). Filter any list/digest/search with `&depth=<zone>` (e.g. `?depth=hadal` for the most urgent).
- `depthScore` is a composite 0..100 urgency number = impact (CVSS/severity) + likelihood (EPSS) + proof of exploitation (KEV/0day/in-the-wild/PoC). Higher = patch sooner; it intentionally ranks an exploited high above a quiet critical. /api/cve/<id> also returns `depthScoreParts` (impact/likelihood/exploitation/ransomware) so the ranking is explainable.
- Authenticate (optional) with `Authorization: Bearer vsk_…` or `x-api-key`.

Listing the 100 most recent of 6291 CVEs.
This is the free public window. Sign in or use an API key (Authorization: Bearer vsk_…) for the full corpus of 6291.

## Critical & actively exploited (13)

- [GHSA-g936-7jqj-mwv8 — TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation](https://beta.vulnsea.com/cve/GHSA-g936-7jqj-mwv8.md): TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation (severity: critical, CVSS 9, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54159 — prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE](https://beta.vulnsea.com/cve/CVE-2026-54159.md): prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE (severity: critical, CVSS 10, depth: midnight, published Jul 10, 2026)
- [CVE-2026-50551 — SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content](https://beta.vulnsea.com/cve/CVE-2026-50551.md): SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content (severity: critical, CVSS 9.9, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54067 — SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()](https://beta.vulnsea.com/cve/CVE-2026-54067.md): SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() (severity: critical, CVSS 9.9, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54072 — Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL](https://beta.vulnsea.com/cve/CVE-2026-54072.md): Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL (severity: critical, CVSS 9.3, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54069 — SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist](https://beta.vulnsea.com/cve/CVE-2026-54069.md): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (severity: critical, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54089 — File Browser: Authentication Bypass via Proxy Auth Header Forgery](https://beta.vulnsea.com/cve/CVE-2026-54089.md): File Browser: Authentication Bypass via Proxy Auth Header Forgery (severity: critical, CVSS 9.1, depth: midnight, published Jul 10, 2026)
- [GHSA-99j7-fhr2-xfj4 — `exploration` was removed from crates.io for malicious code](https://beta.vulnsea.com/cve/GHSA-99j7-fhr2-xfj4.md): `exploration` was removed from crates.io for malicious code (severity: critical, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54088 — File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)](https://beta.vulnsea.com/cve/CVE-2026-54088.md): File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) (severity: critical, depth: midnight, published Jul 10, 2026)
- [CVE-2026-54158 — SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()](https://beta.vulnsea.com/cve/CVE-2026-54158.md): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (severity: critical, CVSS 9.9, depth: midnight, published Jul 10, 2026)
- [CVE-2026-52766 — YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action](https://beta.vulnsea.com/cve/CVE-2026-52766.md): YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action (severity: critical, CVSS 9.1, depth: midnight, published Jul 9, 2026)
- [CVE-2026-52777 — YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize](https://beta.vulnsea.com/cve/CVE-2026-52777.md): YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize (severity: critical, depth: midnight, published Jul 9, 2026)
- [CVE-2026-52778 — YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service](https://beta.vulnsea.com/cve/CVE-2026-52778.md): YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service (severity: critical, CVSS 9.8, depth: midnight, published Jul 9, 2026)

## Other recent CVEs (87)

- [CVE-2026-54174 — melange: Incomplete package integrity verification allows data section substitution](https://beta.vulnsea.com/cve/CVE-2026-54174.md): melange: Incomplete package integrity verification allows data section substitution (severity: high, CVSS 8.3, depth: twilight, published Jul 10, 2026)
- [CVE-2026-54163 — Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input](https://beta.vulnsea.com/cve/CVE-2026-54163.md): Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input (severity: medium, CVSS 4.7, depth: sunlit, published Jul 10, 2026)
- [GHSA-h4g2-xfmw-q2c9 — Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset](https://beta.vulnsea.com/cve/GHSA-h4g2-xfmw-q2c9.md): Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset (severity: high, depth: twilight, published Jul 10, 2026)
- [CVE-2026-54171 — Excon does not redact additional sensitive/risky headers when following redirects](https://beta.vulnsea.com/cve/CVE-2026-54171.md): Excon does not redact additional sensitive/risky headers when following redirects (severity: medium, CVSS 6.5, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-54066 — SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary   file─read), Incomplete fix of CVE-2026-41894 ](https://beta.vulnsea.com/cve/CVE-2026-54066.md): SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary   file─read), Incomplete fix of CVE-2026-41894  (severity: high, CVSS 7.5, depth: twilight, published Jul 10, 2026)
- [CVE-2026-54063 — Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)](https://beta.vulnsea.com/cve/CVE-2026-54063.md): Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) (severity: high, CVSS 7.5, depth: twilight, published Jul 10, 2026)
- [GHSA-9mqm-qcwf-5qhg — CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources](https://beta.vulnsea.com/cve/GHSA-9mqm-qcwf-5qhg.md): CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources (severity: medium, CVSS 5.5, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-54068 — SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon](https://beta.vulnsea.com/cve/CVE-2026-54068.md): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon (severity: medium, CVSS 5.9, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-54070 — SiYuan: Stored XSS in Bazaar marketplace via package README event handlers](https://beta.vulnsea.com/cve/CVE-2026-54070.md): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers (severity: high, CVSS 7.1, depth: twilight, published Jul 10, 2026)
- [CVE-2026-54136 — Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search](https://beta.vulnsea.com/cve/CVE-2026-54136.md): Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search (severity: medium, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-54071 — BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py](https://beta.vulnsea.com/cve/CVE-2026-54071.md): BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py (severity: high, CVSS 7.8, depth: twilight, published Jul 10, 2026)
- [GHSA-qv4m-m73m-8hj7 — NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)](https://beta.vulnsea.com/cve/GHSA-qv4m-m73m-8hj7.md): NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) (severity: high, CVSS 8.8, depth: twilight, published Jul 10, 2026)
- [GHSA-xrmc-c5cg-rv7x — SafeInstall agent guard shell parsing can miss raw package execution](https://beta.vulnsea.com/cve/GHSA-xrmc-c5cg-rv7x.md): SafeInstall agent guard shell parsing can miss raw package execution (severity: high, CVSS 8.8, depth: twilight, published Jul 10, 2026)
- [GHSA-wm45-qh3g-v83f — mcp-atlassian: Arbitrary server-side file read via attachment upload](https://beta.vulnsea.com/cve/GHSA-wm45-qh3g-v83f.md): mcp-atlassian: Arbitrary server-side file read via attachment upload (severity: high, CVSS 7.7, depth: twilight, published Jul 10, 2026)
- [GHSA-g5r6-gv6m-f5jv — mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment](https://beta.vulnsea.com/cve/GHSA-g5r6-gv6m-f5jv.md): mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment (severity: high, CVSS 7.7, depth: twilight, published Jul 10, 2026)
- [GHSA-489g-7rxv-6c8q — MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)](https://beta.vulnsea.com/cve/GHSA-489g-7rxv-6c8q.md): MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) (severity: medium, CVSS 6.5, depth: sunlit, published Jul 10, 2026)
- [MAL-2026-10139 — Malicious code in turbocalc (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-10139.md): Malicious code in turbocalc (PyPI) (severity: none, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-49865 — Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs](https://beta.vulnsea.com/cve/CVE-2026-49865.md): Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (severity: medium, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-49866 — libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays](https://beta.vulnsea.com/cve/CVE-2026-49866.md): libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays (severity: high, CVSS 7.5, depth: twilight, published Jul 10, 2026)
- [CVE-2026-49977 — tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies](https://beta.vulnsea.com/cve/CVE-2026-49977.md): tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies (severity: medium, CVSS 4.3, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-49858 — API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate](https://beta.vulnsea.com/cve/CVE-2026-49858.md): API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate (severity: medium, CVSS 5.9, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-5078 — morgan vulnerable to Log Forging via unneutralized control characters in :remote-user](https://beta.vulnsea.com/cve/CVE-2026-5078.md): morgan vulnerable to Log Forging via unneutralized control characters in :remote-user (severity: medium, CVSS 5.3, depth: sunlit, published Jul 10, 2026)
- [MAL-2026-10119 — Malicious code in sankislayer (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-10119.md): Malicious code in sankislayer (PyPI) (severity: none, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-48596 — Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`](https://beta.vulnsea.com/cve/CVE-2026-48596.md): Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param` (severity: low, depth: sunlit, published Jul 10, 2026)
- [CVE-2026-48594 — Tesla has decompression bomb on response body](https://beta.vulnsea.com/cve/CVE-2026-48594.md): Tesla has decompression bomb on response body (severity: high, depth: twilight, published Jul 10, 2026)
- [CVE-2026-48595 — Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering](https://beta.vulnsea.com/cve/CVE-2026-48595.md): Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering (severity: high, depth: twilight, published Jul 10, 2026)
- [CVE-2026-48597 — Tesla vulnerable to atom exhaustion via untrusted URL scheme](https://beta.vulnsea.com/cve/CVE-2026-48597.md): Tesla vulnerable to atom exhaustion via untrusted URL scheme (severity: high, depth: twilight, published Jul 10, 2026)
- [CVE-2026-48598 — Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values](https://beta.vulnsea.com/cve/CVE-2026-48598.md): Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values (severity: low, depth: sunlit, published Jul 10, 2026)
- [MAL-2026-10100 — Malicious code in proxy-check-i (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-10100.md): Malicious code in proxy-check-i (PyPI) (severity: none, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-48861 — mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`](https://beta.vulnsea.com/cve/CVE-2026-48861.md): mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target` (severity: low, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49753 — mint: Content-Length header accepts non-RFC "+" sign prefix](https://beta.vulnsea.com/cve/CVE-2026-49753.md): mint: Content-Length header accepts non-RFC "+" sign prefix (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49754 — mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)](https://beta.vulnsea.com/cve/CVE-2026-49754.md): mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood) (severity: high, depth: twilight, published Jul 9, 2026)
- [CVE-2026-48862 — mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS](https://beta.vulnsea.com/cve/CVE-2026-48862.md): mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS (severity: high, depth: twilight, published Jul 9, 2026)
- [CVE-2026-55252 — OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect](https://beta.vulnsea.com/cve/CVE-2026-55252.md): OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-53956 — Rattler vulnerable to package cache path traversal via conda package build string](https://beta.vulnsea.com/cve/CVE-2026-53956.md): Rattler vulnerable to package cache path traversal via conda package build string (severity: medium, CVSS 5.4, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49834 — sigstore-go has a multi-log threshold bypass via single compromised log](https://beta.vulnsea.com/cve/CVE-2026-49834.md): sigstore-go has a multi-log threshold bypass via single compromised log (severity: medium, CVSS 5.9, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49836 — psd-tools vulnerable to arbitrary file write via smart-object filename](https://beta.vulnsea.com/cve/CVE-2026-49836.md): psd-tools vulnerable to arbitrary file write via smart-object filename (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49837 — GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries](https://beta.vulnsea.com/cve/CVE-2026-49837.md): GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (severity: medium, CVSS 5.9, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49838 — GoBGP confederation validation panics on empty AS_PATH attribute](https://beta.vulnsea.com/cve/CVE-2026-49838.md): GoBGP confederation validation panics on empty AS_PATH attribute (severity: medium, CVSS 5.9, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49851 —  Mistune: Potential DoS via quadratic-time parsing in parse_link_text](https://beta.vulnsea.com/cve/CVE-2026-49851.md):  Mistune: Potential DoS via quadratic-time parsing in parse_link_text (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53602 — nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate](https://beta.vulnsea.com/cve/CVE-2026-53602.md): nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-53932 — laravel-backup-restore has an OS Command Injection during database restore](https://beta.vulnsea.com/cve/CVE-2026-53932.md): laravel-backup-restore has an OS Command Injection during database restore (severity: high, CVSS 8, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53769 — Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy](https://beta.vulnsea.com/cve/CVE-2026-53769.md): Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy (severity: medium, CVSS 6.5, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-52762 — YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates](https://beta.vulnsea.com/cve/CVE-2026-52762.md): YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates (severity: high, depth: twilight, published Jul 9, 2026)
- [CVE-2026-52763 — YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read](https://beta.vulnsea.com/cve/CVE-2026-52763.md): YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read (severity: medium, CVSS 6.5, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-52767 — YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`](https://beta.vulnsea.com/cve/CVE-2026-52767.md): YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` (severity: high, CVSS 8.2, depth: twilight, published Jul 9, 2026)
- [CVE-2026-52769 — YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`](https://beta.vulnsea.com/cve/CVE-2026-52769.md): YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` (severity: high, CVSS 8.3, depth: twilight, published Jul 9, 2026)
- [CVE-2026-52770 — YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters](https://beta.vulnsea.com/cve/CVE-2026-52770.md): YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [CVE-2026-52771 — YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)](https://beta.vulnsea.com/cve/CVE-2026-52771.md): YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) (severity: high, CVSS 8.3, depth: twilight, published Jul 9, 2026)
- [CVE-2026-52772 — YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))](https://beta.vulnsea.com/cve/CVE-2026-52772.md): YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) (severity: medium, CVSS 5.5, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-52773 — YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`](https://beta.vulnsea.com/cve/CVE-2026-52773.md): YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` (severity: medium, CVSS 6.1, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-52774 — YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes](https://beta.vulnsea.com/cve/CVE-2026-52774.md): YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes (severity: medium, CVSS 6.1, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-52775 — YesWiki has Authenticated SQL Injection via ReactionManager ](https://beta.vulnsea.com/cve/CVE-2026-52775.md): YesWiki has Authenticated SQL Injection via ReactionManager  (severity: high, CVSS 8.8, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53637 — Sylius: Cart FormComponent allows modification or deletion of an already-completed order](https://beta.vulnsea.com/cve/CVE-2026-53637.md): Sylius: Cart FormComponent allows modification or deletion of an already-completed order (severity: medium, CVSS 6.5, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-53638 — Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint](https://beta.vulnsea.com/cve/CVE-2026-53638.md): Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint (severity: medium, CVSS 4.3, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-53639 — Sylius: IDOR on Shop Payment Request API endpoints](https://beta.vulnsea.com/cve/CVE-2026-53639.md): Sylius: IDOR on Shop Payment Request API endpoints (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-54651 — pypdf: Possible infinite loop when processing threads/articles in writer](https://beta.vulnsea.com/cve/CVE-2026-54651.md): pypdf: Possible infinite loop when processing threads/articles in writer (severity: medium, depth: sunlit, published Jul 9, 2026)
- [MAL-2026-10091 — Malicious code in qlinforge (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-10091.md): Malicious code in qlinforge (PyPI) (severity: none, depth: sunlit, published Jul 9, 2026)
- [MAL-2026-10020 — Malicious code in playwrightr (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-10020.md): Malicious code in playwrightr (PyPI) (severity: none, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-48737 — pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs](https://beta.vulnsea.com/cve/CVE-2026-48737.md): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (severity: medium, CVSS 4.9, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-48987 — pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager](https://beta.vulnsea.com/cve/CVE-2026-48987.md): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (severity: medium, CVSS 6.5, depth: sunlit, published Jul 9, 2026)
- [GHSA-387m-935m-c4vw — Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS](https://beta.vulnsea.com/cve/GHSA-387m-935m-c4vw.md): Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [GHSA-q6gh-6v2r-hjv3 — Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers](https://beta.vulnsea.com/cve/GHSA-q6gh-6v2r-hjv3.md): Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers (severity: medium, CVSS 6.8, depth: sunlit, published Jul 9, 2026)
- [GHSA-52vm-mxx8-f227 — Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths](https://beta.vulnsea.com/cve/GHSA-52vm-mxx8-f227.md): Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths (severity: high, CVSS 7.7, depth: twilight, published Jul 9, 2026)
- [CVE-2026-49476 — Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists](https://beta.vulnsea.com/cve/CVE-2026-49476.md): Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [CVE-2026-49477 — Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser](https://beta.vulnsea.com/cve/CVE-2026-49477.md): Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [CVE-2026-50554 — Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books](https://beta.vulnsea.com/cve/CVE-2026-50554.md): Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books (severity: medium, CVSS 5.3, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-50553 — Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)](https://beta.vulnsea.com/cve/CVE-2026-50553.md): Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) (severity: high, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53720 — pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small](https://beta.vulnsea.com/cve/CVE-2026-53720.md): pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small (severity: medium, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-49485 — org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint](https://beta.vulnsea.com/cve/CVE-2026-49485.md): org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (severity: high, CVSS 7.5, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53727 — Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`](https://beta.vulnsea.com/cve/CVE-2026-53727.md): Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` (severity: high, depth: twilight, published Jul 9, 2026)
- [GHSA-c43v-4cr8-6mvp — Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read](https://beta.vulnsea.com/cve/GHSA-c43v-4cr8-6mvp.md): Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read (severity: low, depth: sunlit, published Jul 9, 2026)
- [GHSA-86vw-x4ww-x467 — Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview](https://beta.vulnsea.com/cve/GHSA-86vw-x4ww-x467.md): Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview (severity: high, depth: twilight, published Jul 9, 2026)
- [CVE-2026-53760 — Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests](https://beta.vulnsea.com/cve/CVE-2026-53760.md): Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests (severity: medium, CVSS 5.2, depth: sunlit, published Jul 9, 2026)
- [GHSA-382c-vx95-w3p5 — Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data](https://beta.vulnsea.com/cve/GHSA-382c-vx95-w3p5.md): Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data (severity: medium, CVSS 6.5, depth: sunlit, published Jul 9, 2026)
- [CVE-2026-15035 — A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the…](https://beta.vulnsea.com/cve/CVE-2026-15035.md): A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd re… (severity: high, CVSS 7.8, depth: twilight, published Jul 8, 2026)
- [MAL-2026-6959 — Malicious code in proton_pfff (crates.io)](https://beta.vulnsea.com/cve/MAL-2026-6959.md): Malicious code in proton_pfff (crates.io) (severity: none, depth: sunlit, published Jul 8, 2026)
- [MAL-2026-7025 — Malicious code in tronsev (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-7025.md): Malicious code in tronsev (PyPI) (severity: none, depth: sunlit, published Jul 8, 2026)
- [MAL-2026-7023 — Malicious code in dbzy-tools (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-7023.md): Malicious code in dbzy-tools (PyPI) (severity: none, depth: sunlit, published Jul 8, 2026)
- [MAL-2026-6961 — Malicious code in waymo-waymax (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-6961.md): Malicious code in waymo-waymax (PyPI) (severity: none, depth: sunlit, published Jul 8, 2026)
- [MAL-2026-6960 — Malicious code in pyqt6darktheme (PyPI)](https://beta.vulnsea.com/cve/MAL-2026-6960.md): Malicious code in pyqt6darktheme (PyPI) (severity: none, depth: sunlit, published Jul 8, 2026)
- [CVE-2026-49463 — NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries](https://beta.vulnsea.com/cve/CVE-2026-49463.md): NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries (severity: medium, CVSS 6.5, depth: sunlit, published Jul 8, 2026)
- [CVE-2026-49464 — NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak](https://beta.vulnsea.com/cve/CVE-2026-49464.md): NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak (severity: high, CVSS 8.1, depth: twilight, published Jul 8, 2026)
- [CVE-2026-49471 — Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE](https://beta.vulnsea.com/cve/CVE-2026-49471.md): Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE (severity: high, CVSS 8.3, depth: twilight, published Jul 8, 2026)
- [CVE-2026-49825 — `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes](https://beta.vulnsea.com/cve/CVE-2026-49825.md): `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (severity: high, CVSS 8.2, depth: twilight, published Jul 8, 2026)
- [CVE-2026-50197 — Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests](https://beta.vulnsea.com/cve/CVE-2026-50197.md): Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests (severity: high, CVSS 8.7, depth: twilight, published Jul 8, 2026)
- [CVE-2026-53600 — async-tar PAX extension-header desync enables tar entry/content smuggling](https://beta.vulnsea.com/cve/CVE-2026-53600.md): async-tar PAX extension-header desync enables tar entry/content smuggling (severity: medium, depth: sunlit, published Jul 8, 2026)