CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

MAL-2026-12225 Malicious code in time-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cbd818e3b29b2b7c9da6f48b3d82baae1af9bd0fa637a2848749bdfea86084 The package advertises itself as a time-formatting utility index.js exports formatDate/capitalize/truncate but ships a postinstall.js lifecycle scrip...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...

Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

MAL-2026-12302 Malicious code in twork-data-services-sme-operations-authorizations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73622aa5b1b1b3f39f914022e80a8429b948186033c2e98d5f5610e93129612 On require of the package, index.js loads compat.js which fetches a platform-specific binary from hostnames assembled by array-join to hide them from...

Malicious code in twork-data-services-role-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc0980e765a4c7250c1ac7ca327daefbe85544498883193c5f5019b08c06b8ec On require, index.js loads init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts assembled via split-string...

CVE-2026-71210

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-71210

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

EUVD-2026-53207

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

EUVD-2026-53037

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller includes/REST/CustomersController.php, which re-registers WooCommerce's customer CRUD routes...

Multiple Vulnerabilities in Hitachi Ops Center Common Services

Overview Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035...

CVE-2026-15573: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-16443: Improper Verification of Cryptographic Signature

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

PT-2026-68144

Name of the Vulnerable Software and Affected Versions Memos affected versions not specified Description Insufficient validation of webhook URLs occurs in the isReservedIP function located in internal/webhook/validate.go. The function checks candidate IPs against a reserved CIDR list but omits the...

Fedora 45 : gst-devtools / gst-editing-services / gstreamer1 / gstreamer1-doc / etc (2026-77f965de7b)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-77f965de7b advisory. 1.28.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but h...

PT-2026-68157

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup located in python/fledge/services/core/api/backup restore.py is susceptible to OS command injection. The handler processes the first extracted t...

PT-2026-68169

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider...

CVE-2026-71250: Server-Side Request Forgery (SSRF)

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...