Malicious code in hydration-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480 The package's main entry dist/index.mjs locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached child process every time the...

CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

EUVD-2026-60382

Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url...

CVE-2026-3035

GitLab EE is affected by an improper authorization check that allows an authenticated user with project Maintainer permissions to access the terminal of a protected environment they are not authorized to use, under certain conditions. The vulnerability affects versions from 11.3 before 19.1.7, 19...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-7487

GitLab EE is affected by an improper authorization check where the access control check is implemented after the asset is accessed . An authenticated user with reporter-role permissions who authored a merge request could reset merge request approval rules under certain conditions. The vulnerabili...

CVE-2026-75896 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5...

CVE-2026-78892

A flaw was found in Chromoting in Google Chrome. A local attacker can exploit an incorrect authorization vulnerability by running a local program. This allows the attacker to bypass system access restrictions...

CVE-2026-12587

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-18664

A flaw was found in NSD. On systems using little-endian architecture, the software incorrectly compares IP addresses against defined Access Control List ACL ranges. This misinterpretation can lead to a bypass of intended access controls, where IP addresses that should be denied access are instead...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Beschreibung: Nutzt den Path-Traversal-Schwachstelle im @fs-Endpunkt des Vite Development Servers CVE-2025-31125 aus, um über manipulierte URLs auf sensible Dateien wie /etc/passwd und /etc/hosts zuzugreifen. Erstellt von Muhammad Waseem. Verwendung: python...

exploit_cve-2007-2447_again

exploitcve-2007-2447again ricorda solo quanto un piccolo errore nella sanitizzazione del nome utente possa darti accesso root all'intera macchina...

CVE-2026-77554

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device...

CVE-2026-77553

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device...

CVE-2026-77551

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device...

CVE-2026-77557

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...