CVE-2026-108388

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

EUVD-2026-100675

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

PT-2026-113428

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user ...

CVE-2026-108388: Incorrect Authorization

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

Malicious code in api-cache-worker (npm)

Source: ossf-package-analysis cc9bdde57f4e80ca9647c2385d252071a1779d2ed98dee773977bac933149638 The OpenSSF Package Analysis project identified 'api-cache-worker' @ 6.1.3 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

SummaryFive routine detail action endpoints check a cache before calling self.getobject. Cache keys are scoped only by pk — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership...

CVE-2026-27838 wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling self.getobject. In versions up to and including 2.4, ache keys are scoped only by pk — no user ID is included. When a victim has previously accessed their routine via the API...

Malicious Package

Overview api-cache-worker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-36774 Malicious code in the-api-cache (npm)

The package the-api-cache was found to contain malicious code...

Malicious code in the-api-cache (npm)

The package the-api-cache was found to contain malicious code...

Malicious code in api-cache-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc9bdde57f4e80ca9647c2385d252071a1779d2ed98dee773977bac933149638 The OpenSSF Package Analysis project identified 'api-cache-worker' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

MAL-2024-10385 Malicious code in api-cache-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc9bdde57f4e80ca9647c2385d252071a1779d2ed98dee773977bac933149638 The OpenSSF Package Analysis project identified 'api-cache-worker' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...