39411 matches found
Apple macOS security vulnerabilities
Apple macOS is a specialized operating system developed by the American company Apple for Mac computers. Versions of Apple macOS Tahoe prior to 26.4 contained a security vulnerability caused by a logical issue, which could allow applications to access sensitive user data...
EUVD-2026-14996
solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...
CVE-2026-33345 solidtime vulnerable to IDOR in private projects
solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/org/projects/project allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index...
EUVD-2026-14976
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter...
CVE-2026-33335 Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from window.open calls directly to shell.openExternal without any validation or protocol allowlisting. An attacker who can place ...
CVE-2019-25631
creationtimestamp| type| source ---|---|--- 2026-03-24 12:59:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhsmw6y5pt2i 2026-03-27 18:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi2p4y3k6g2a...
Malicious Package
Overview fancode-web-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-2130 Malicious code in fancode-web-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...
Malicious code in fancode-web-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...
Security Bulletin: SOAR App Host is using a component with a known vulnerability (CVE-2026-1188)
Summary IBM SOAR App Host uses an older version of the OMR component in OpenJ9 JVM that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 1.15.7.0 Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTIO...
org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=6.0.1, <=6.1.0-rc2), org.apereo.cas:cas-server-webapp-config-server (>=6.0.1, <=6.1.0-rc1) +10 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.1.0.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...
ai.hyacinth.framework:core-service-config-server (0.5.0), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=einstein.sr1, <=einstein.sr3) +2 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.1.1.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...
com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +4 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.0.2.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...
CVE-2026-33286
creationtimestamp| type| source ---|---|--- 2026-03-24 00:23:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrcou436g2d 2026-03-24 02:58:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrle3s3xm2r 2026-03-24 03:00:32+00:00| seen|...
CVE-2026-33176
creationtimestamp| type| source ---|---|--- 2026-03-24 00:01:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrbh4rklw2x...
PT-2026-27529
Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description A flaw exists in how the operating system parses directory paths. This could allow an application to access sensitive user data due to insufficient path validation. Recommendations Update to macOS versi...
PT-2026-27562
Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description A logic issue existed due to insufficient restrictions, allowing a malicious application to potentially escape its sandbox. The issue was resolved by implementing improved restrictions. Recommendations...
PT-2026-46537
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in WebAppInstalls allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page...
Proton security vulnerabilities
Proton is an independent application developed by Steventhanna’s developer, which uses Electron to quickly preview and edit Markdown files. Versions of Proton prior to 1.6.16 have security vulnerabilities; these vulnerabilities stem from out-of-bound writing, which may lead to issues with the...
CVE-2026-4741: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in TeamJCD JoyConDroid app/src/main/java/com/rdapps/gamepad/util modules. This vulnerability is associated with program files UnzipUtil.Java. This issue affects JoyConDroid: through 1.0.93...