Malicious code in @ikyyjee/ikyysinggle (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

CVE-2026-103668

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

EUVD-2026-94282

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

EUVD-2026-94281

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

CVE-2026-96408

A code injection vulnerability exists in the upgrade script of Movable Type . This flaw could enable an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product. No specific exploit information or remediation versions are provided in the documents.

CVE-2026-93684

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

CVE-2026-93684

Apache Impala (up to and including version 4.5.2 ) is vulnerable to stored XSS (CWE-79). An SQL user with only SELECT permissions can inject malicious JavaScript into a table alias . This script can then execute in the browser of another user who views the query plan via the Impala Web UI . To re...

CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

CVE-2026-98359

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. When an asynchronous RDMA port query retrieves link speed settings, the kernel fails to verify whether the associated network device is being unregistered before invoking its operations. A local user could exploit...

CVE-2026-107352: Missing Authorization

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

Linux Distros Unpatched Vulnerability : CVE-2026-104047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query...

PT-2026-111412

Name of the Vulnerable Software and Affected Versions Payload CMS versions prior to 3.90.0 Payload CMS versions prior to 4.0.0-canary.34 Description An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input provided to the in and not in query...

CVE-2026-103668: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

PT-2026-107475

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product...

PT-2026-107472

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

PT-2026-107435

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...