Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

CVE-2026-13741

creationtimestamp| type| source ---|---|--- 2026-07-16 10:40:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqr2civkdq2x 2026-07-16 12:00:11+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqr6rcvmum27...

CVE-2026-15099

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...

CVE-2026-15458

creationtimestamp| type| source ---|---|--- 2026-07-16 08:29:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqszdqisv2m...

CVE-2026-12510

creationtimestamp| type| source ---|---|--- 2026-07-16 07:58:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqrb5ipg22a...

CVE-2026-12492

creationtimestamp| type| source ---|---|--- 2026-07-16 07:47:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqobblln2c 2026-07-16 16:40:30+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrofv6bjr2j...

CVE-2026-15652

creationtimestamp| type| source ---|---|--- 2026-07-16 04:29:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqfljtpno2w...

CVE-2026-3842

creationtimestamp| type| source ---|---|--- 2026-07-16 04:24:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqfcl5gj42h 2026-07-21 21:17:46+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr6qaxfs4o2l 2026-07-21 21:17:49+00:00| seen|...

CVE-2026-12434

creationtimestamp| type| source ---|---|--- 2026-07-16 04:00:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqdx2slhz2m...

CVE-2026-55576

creationtimestamp| type| source ---|---|--- 2026-07-16 00:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwwfqvfb2l...

PT-2026-60663

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...

PT-2026-60543

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

ROS-20260716-73-0027

The vulnerability of the Omnibox address bar in Google Chrome browsers on iOS operating systems is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to replace the content in the URL bar using a specially created domain name...

CVE-2026-46404: Server-Side Request Forgery (SSRF)

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23...

PT-2026-60688

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description An issue exists in the Wasm HTTP fetch mechanism where the getFileFromGZ function calls io.ReadAll on a raw gzip.Reader without an output bound. While the compressed input is capped at...

PT-2026-60553

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.3 Description An issue exists in cyrus-imapd where URLAUTH token forgery is possible due to a missing mboxkey. An attacker who knows a folder name on a victim's account that has no existing auth URL can forge ...

CVE-2026-47086

CYRUS IMAPD has a vulnerability CVE-2026-47086 affecting Cyrus IMAP up to version 3.12.2. The GENURLAUTH feature allows issuance of URLAUTH tokens by any authenticated user for named mailboxes, bypassing ACLs and enabling reading mail from those mailboxes without granted permissions. The issue is...

CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

PT-2026-60555

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...