linux-malware

linux-malware Rolling 7 day view of updates from this repo Submissions? Press/academia https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control,...

bumblebee

Threat Intelligence Exposure Catalogs Maintained exposure catalogs for recent supply-chain campaigns, built from public threat-intelligence reporting with Perplexity Computer and updated via PRs as fresh campaigns are reported. Pass a catalog to a scan with --exposure-catalog . Review the entries...

CVE-2026-17278

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to multiple vulnerabilities caused by improper authentication . Because client-supplied information is not sufficiently verified, a remote attacker could appear as a trusted party to gain unauthorized access to sensitive API catal...

EUVD-2026-118671

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a...

Webasyst Shop-Script CMS Path Traversal

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files and directories on the server...

FOQUZ Platform Path Restriction Data Compromise

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

iFlightDoc Path Traversal Unauthorized Access

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

EUVD-2026-117993

The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting XSS when a user interacts with the crafted content...

CVE-2026-65022

The BigFix Mobile MDM App Catalog / App Store preview is vulnerable to Cross-Site Scripting (XSS) . The software fails to properly sanitize or encode user-supplied HTML before rendering it, allowing injected HTML to be displayed to users. This may result in XSS execution when a user interacts wit...

CVE-2026-115923

A flaw was found in the Backstage plugin-catalog-backend component. This vulnerability allows an authenticated remote attacker with catalog location creation permissions to bypass catalog location rules and import untrusted content. By supplying URLs containing percent-encoded path segments, the...

CVE-2026-122327

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

CVE-2026-81828

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...

CVE-2026-81734

Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly...

CVE-2026-66903

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue...

CVE-2026-122327 Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

CVE-2026-83538

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human...

CVE-2026-114229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a...

CVE-2026-66903 Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue...

CVE-2026-66903

Apache OFBiz versions before 24.09.08 are vulnerable to an Authenticated Path Traversal in the Catalog Image Management component. This security flaw allows an authenticated attacker to write image files outside of the intended directory. To mitigate this issue, users are recommended to upgrade t...