@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: SNYK:JS-OPENZEPPELINWIZARD-17817911...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

PT-2026-51017

Name of the Vulnerable Software and Affected Versions ProxySQL versions 3.0.0 through 3.0.8 Description The GenAI/MCP run sql readonly tool violates its read-only contract for MySQL targets. The tool validates input using a substring blacklist and a first-keyword allowlist, but executes the SQL...

CVE-2026-54106

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network...

EUVD-2026-37911

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...

EUVD-2026-37910

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...

CVE-2026-54103

CVE-2026-54103 affects GAO EPDS and CBCA EDS, where the /update-profile/N endpoint does not require authentication for password changes. The vulnerability allows a remote attacker to change an arbitrary user’s password without credentials. This result is supported by the CVSS data indicating high...

CVE-2026-54105: Authorization Bypass Through User-Controlled Key

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...

PT-2026-50703

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...

CVE-2026-54103: Missing Authentication for Critical Function

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could chang...

PT-2026-50706

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...

CVE-2026-54104: Client-Side Enforcement of Server-Side Security

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...

CVE-2026-54106: Improper Verification of Source of a Communication Channel

The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network...

EUVD-2026-36710

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload ...

CVE-2026-34027: Unrestricted Upload of File with Dangerous Type

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload ...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-48054 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-48054 Source advisory: OSV:GHSA-4X76-22X2-RX8V...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-48054 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-48054 Source advisory: SNYK:JS-OPENZEPPELINWIZARD-17756776...

nebula-mesh: Decrypted CA private key persists in heap after signing

internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobilebundle.go:40 use the manager for one Sign...

Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...

MAL-2026-5528 Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...