CVE-2026-59721

Hoppscotch (open source API development ecosystem) contains a Rooted Command Execution risk before version 2026.6.0 due to the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepting an attacker-controlled MAILER_SMTP_URL. The validateSMTPUrl in utils.ts permits path, query, or f...

CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

EUVD-2026-42653

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

CVE-2026-59721

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

CVE-2026-51602

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 firmware V31.1.9.91 allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL fiel...

GHSA-387M-935M-C4VW

creationtimestamp| type| source ---|---|--- 2026-07-09 17:11:45+00:00| seen| https://gist.github.com/alon710/4972c27e69247db8e70c7471b199efc4...

SUSE-SU-2026:2817-1 Security update for go1.25

This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta content...

CVE-2026-59215 Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parentid to the channel in the URL, allowing an authenticated user to reference a message from another private or DM channel and disclose...

Malicious code in eslint-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7 Package declares postinstall: node lib/utils/index.js, which spawns a detached, stdio-suppressed Node child spawn with detached:true, stdio:'ignore',...

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PYSEC-2026-2683 Open Redirect vulnerability in jupyterhub and notebook

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers Chrome, Firefox in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a baseurl prefix are not affecte...

CVE-2026-54799

creationtimestamp| type| source ---|---|--- 2026-07-09 16:42:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqa3brethk24 2026-07-10 14:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccogp5db24 2026-07-16 16:15:05+00:00| seen|...

Malicious code in cookie-js-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...

CVE-2026-61474

creationtimestamp| type| source ---|---|--- 2026-07-09 16:07:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7zdryo4a2g...

Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

MAL-2026-10080 Malicious code in webrix-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname,...

MAL-2026-10041 Malicious code in chai-as-buffered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a [email protected] is a typosquat lure name resembles chai-as-promised; README and module exports impersonate the pino logger whose actual...

MAL-2026-10049 Malicious code in chai-await-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...

MAL-2026-10056 Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...