CVE-2026-82667: Server-Side Request Forgery (SSRF)

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

PT-2026-84043

Name of the Vulnerable Software and Affected Versions cu silicon versions prior to 0.1.6 Description A remote issue exists in the edit Endpoint component within the views.py file. The create app function is susceptible to manipulation, which results in missing authentication, allowing an attacker...

CVE-2026-82666: Improper Control of Generation of Code

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

Malicious Package

Overview auth-app-streamlit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15516 Malicious code in nx-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8671a9b563cebe9de36365a80edc1f242be492933cadb3e45ea590c8c5e1e115 package.json declares its own name nx-app as a dependency whose value is a raw HTTPS URL https://repo.securityctrl.com/nx-app rather than a semver...

Malicious code in nx-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8671a9b563cebe9de36365a80edc1f242be492933cadb3e45ea590c8c5e1e115 package.json declares its own name nx-app as a dependency whose value is a raw HTTPS URL https://repo.securityctrl.com/nx-app rather than a semver...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67813

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

Root-My-Galaxy-Payloads-Testing

Root My Galaxy Payloads This repository contains the device-s...

The vulnerability of the App Package Installer installation program for Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the App Package Installer installation program for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the App Package Installer installation program for Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the App Package Installer installation program for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...