EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859

The Heym application (versions before 0.0.106 ) is vulnerable to a credential exfiltration flaw in the POST /api/credentials/test endpoint. The root cause is an URL override vulnerability where collaborators with shared credential access can manipulate the config parameter. By overriding the dest...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

EUVD-2026-87839

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100859: Server-Side Request Forgery (SSRF)

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100849: Server-Side Request Forgery (SSRF)

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

PT-2026-99479

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106 Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the...

PT-2026-99469

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Insufficient URL validation in the getValidUrl function within the AbstractConnector.php file allows for server-side request forgery. The validation process only rejects literal link-local IP...

Malicious Package

Overview epic-react-test-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview agency-test-exercise is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tego-managed-agents-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

BIT-GITLAB-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

penetration-testing-system-network-security

Penetration Testing & System and Network Security Team univer...

Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

MAL-2026-17170 Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

Malicious Package

Overview @test1230504/test-publish-verify is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...