14295 matches found
CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
EUVD-2026-62591
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
EEF-CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Summary Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic...
CVE-2026-73829
ZenHive mpp (Elixir MPP library) versions 0.2.0 through 0.6.0 contain a TOCTOU race condition in the type="hash" credential path of MPP.Methods.Tempo.verify/2. The dedup check-then-mark sequence is non-atomic: check_hash_unused/2 reads the store, an on-chain receipt is verified, and only then doe...
Malicious Package
Overview dolyame-boxy-atom-bnpl-store-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
CVE-2026-14196
The WCFM Marketplace WordPress plugin (versions before 3.8.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a marketplace vendor owns a specific review before processing requests to unapprove or delete it. This allows any authorized vendor to mod...
CVE-2026-72117
A flaw was found in the Linux kernel's CAN Controller Area Network Broadcast Manager BCM module. A data race condition exists in the bcmrxhandler function where the rxstamp and rxifindex values are written without proper locking. This can lead to a "torn store" of the 64-bit rxstamp on 32-bit...
PT-2026-78725
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the schedule search capabilit...
PT-2026-78539
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
PT-2026-78832
In Splunk On-Call VictorOps app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface API key from the App Key Value Store KV Store. The exposure is possible because the Splunk On-Call...
CVE-2026-76405: Cleartext Storage of Sensitive Information
In Splunk On-Call VictorOps app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface API key from the App Key Value Store KV Store. The exposure is possible because the Splunk On-Call...
CVE-2026-76253: Improper Privilege Management
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...
EUVD-2026-61485
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...
CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...
CVE-2026-53454
Prior to version 2.5.2, Blueprint Studio configured Git's credential.helper store, writing usernames and access tokens in plaintext to a .git-credentials file accessible to other users/processes on the same filesystem, exposing Home Assistant Git credentials; the issue is fixed in 2.5.2. No explo...
CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...
GHSA-59XM-4M8C-G3XJ MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...
CVE-2026-73392
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965...
Meta Ran Ads for an App That Promised to Nudify Female Politicians
One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED...