Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...

MAL-2026-17185 Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...

BIT-NEXTCLOUD-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

MAL-2026-17182 Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

CVE-2026-100379: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...

Linux Distros Unpatched Vulnerability : CVE-2026-57178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without...

PT-2026-99123

Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Wikipedia Android App affected versions not specified Description An issue exists that allows an unauthorized actor to access, intercept, or modify HTTP cookies, leading to the exposure of sensitive information...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

GHSA-3C93-F73F-QC9H social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

DEBIAN-CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the "vk-app" backend accepted VK application callback data without verifying the callback signature when the "authkey" parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

EUVD-2026-86312

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

The Python Social Auth library, specifically the vk-app backend , is vulnerable to an authentication bypass in versions prior to 5.0.0 . The root cause is that the backend accepts VK application callback data without verifying the signature when the auth_key parameter is missing. This allows an a...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...