Linux Distros Unpatched Vulnerability : CVE-2026-104056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a...

PT-2026-106036

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?query type=user mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. T...

CVE-2026-59357 - Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions | Cloud Foundry

Severity High CVSS score: 7.2 High CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – Confirmed in UAA v4.5.0 to v79.6.0 inclusive Description Insufficient verification of data...

Spring Office Hours Podcast: S5E25 - Future of Software Development with Josh Long

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by the legendary Josh Long. In this episode, we will look into the future of software development. We will also address at least one hot take that recently made the round...

PT-2026-106030

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/project id/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

...[ More ]

Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tech · github.com/abraxas/veneficus Crédit : @YoSoth0 Veneficus Mini v3.0 Kit d'implant Windows 10/11 x64 : un stager PowerShell , un PE Rust , et un Cloudflare Worker qui alerte l'opérateur sur Telegram. Le stager resources/loader.ps1 est conçu...

CVE-2024-57523.

CVE-2024-57523 - Vulnérabilité CSRF dans Users.php - SourceCodester Packers and Movers Management System 1.0 Description Ce dépôt contient une preuve de concept PoC pour une vulnérabilité Cross-Site Request Forgery CSRF dans le Packers and Movers Management System 1.0 de SourceCodester. La...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE المعروف بـ msdt follina معلومة : ثغرة يوم الصفر الجديدة في Microsoft Office تُستخدم في هجمات لتنفيذ PowerShell ملخص في 29 مايو 2022، اكتشف فريق NaoSec، وهو فريق مستقل لأبحاث الأمن السيبراني، مستند Office ضارًا تمت مشاركته على Virustotal. يستخدم هذا...

mav-raiders

MAV Raiders Security Analysis and Exploitation of MAVLink-B...

MAL-2026-17501 Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

Malicious code in dom-focus-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7baf5178b3cd02ae8e6e2c01e8cf305fd9670118428c4d3ef94ac0caef6fc4e8 thunderboltRegistry.js runs an immediately-invoked function at module load that uses childprocess.execSync to run host reconnaissance commands whoami...

MAL-2026-17503 Malicious code in dom-focus-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7baf5178b3cd02ae8e6e2c01e8cf305fd9670118428c4d3ef94ac0caef6fc4e8 thunderboltRegistry.js runs an immediately-invoked function at module load that uses childprocess.execSync to run host reconnaissance commands whoami...

Malicious code in oleh-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake...

MAL-2026-17516 Malicious code in oleh-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - Contournement d'autorisation ajaxlookup de SQLAdmin Résumé exécutif Ce référentiel contient un laboratoire Docker local pour reproduire CVE-2026-46645, une vulnérabilité de contournement d'autorisation affectant le point de terminaison ajaxlookup de SQLAdmin. SQLAdmin est une...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

MAL-2026-17528 Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...