corgy-erp (>=0.0.1, <=1.0.7), django-account-rcg-chandu (0.1.0) +2 more potentially affected by CVE-2026-15307 via django (3.0.6)

django PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - corgy-erp =0.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

corgy-erp (>=0.0.1, <=1.0.7), django-account-rcg-chandu (0.1.0) +2 more potentially affected by CVE-2026-15830 via django (3.0.6)

django PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - corgy-erp =0.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-15830 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

corgy-erp (>=0.0.1, <=1.0.7), django-account-rcg-chandu (0.1.0) +2 more potentially affected by CVE-2026-15830 via django (3.0.6)

django PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - corgy-erp =0.0.1, =1.0.1, =1.0.6 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-15830 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

user-scanner v1.4.3

User Scanner A powerful 2-in-1 OSINT suite engineered for deep Email and Username Intelligence. With 380+ total scan vectors —including 155+ email-integrated sites and 225+ username platforms —you can map digital footprints, analyze target behavior, uncover interests, full metadata of usernames a...

Malicious code in @or-sdk/account-settings (npm)

npm/@or-sdk/account-settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11665 Malicious code in @or-sdk/account-settings (npm)

npm/@or-sdk/account-settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-66884

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

CVE-2026-66884

The CVE-2026-66884 affects oidcc_plug (Oidcc.Plug.AuthorizationCallback.call/2) in Erlang Ecosystem Foundation. A callback with no Oidcc.Plug.Authorize session is processed with security checks disabled, causing nonce, state, PKCE, IP and user-agent checks to be skipped and permitting state-less ...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

CVE-2026-66884

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

EUVD-2026-52657

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

Open WebUI: Account enumeration via observable login timing discrepancy

SummaryThe /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

PYSEC-2026-3594 Open WebUI: Account enumeration via observable login timing discrepancy

Summary The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google deleted three AI agent workflows from its Agent Development Kit ADK Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posti...

Malicious code in cacheable-request (npm)

npm/cacheable-request version 13.0.20 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases throug...