CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

MAL-2026-13030 Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

MAL-2026-13029 Malicious code in boxy-add-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701 On require'boxy-add-link', index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated...

Malicious code in boxy-add-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701 On require'boxy-add-link', index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated...

CVE-2026-18901

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-18901 H3C NX15 Web API esps service.add routine

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

EUVD-2026-53030

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-18901

The CVE-2026-18901 entry concerns H3C NX15 V100R017 Web API. The vulnerable component is the function service.add in the /api/esps endpoint, whose manipulation can expose a dangerous routine. The vulnerability is exploitable remotely, and public exploits/PoCs have been disclosed. References indic...

SUSE CVE-2026-65903

DOMPurify before 3.4.0 contains a logic error in the ADDTAGS function where short-circuit evaluation allows forbidden tags to bypass FORBIDTAGS restrictions. Attackers can craft input containing tags listed in FORBIDTAGS that are also added via ADDTAGS function, causing them to be retained in...

SUSE CVE-2026-65911

In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...

nas-web.add_user Arbitrary Command Execution

The vulnerability of the nas-web.adduser function in the GL.iNet GL-MT3000 router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-67871

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

PT-2026-68067

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm iptfs component where the iptfs skb add frags function fails to propagate the SKBFL SHARED FRAG flag to the destination SKB's skb shinfo-flags when copying...

CVE-2026-67871

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

PT-2026-67967

Name of the Vulnerable Software and Affected Versions Kadence Memberships versions prior to 4.0.1 Description An issue exists where the legacy lost-password handler rc process lost password form consumes the attacker-controlled rc redirect POST parameter into two unvalidated sinks in...

ROS-20260805-73-0011

The vulnerability of the deviceadd function in Linux kernel is related to memory release errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-67870

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

CVE-2026-18811 H3C NX15 esps add command injection

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The...