10122 matches found
CVE-2026-88890
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...
CVE-2026-88891 OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations
OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion,...
CVE-2026-88890 OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...
CVE-2026-88890 OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...
Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics
CVE-2022-24637 — Open Web Analytics prior to 1.7.4 Defensiv...
documentsreader (1.1.5), midastrader (>=1.0.1, <=1.0.23) +1 more potentially affected by CVE-2026-55073 via weasyprint (62.1.0)
weasyprint PYPI version 62.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - documentsreader 1.1.5 - midastrader =1.0.1, =1.0.1, =1.0.7 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...
Malicious code in etoro-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...
MAL-2026-16112 Malicious code in etoro-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...
Malicious Package
Overview etoro-analytics is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the etoro-analytics...
CVE-2026-88890: Improper Neutralization of Special Elements used in an SQL Command
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...
irflow-timeline v1.0.13
IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...
documentsreader (1.1.5), midastrader (>=1.0.1, <=1.0.23) +1 more potentially affected by CVE-2026-55073 via weasyprint (62.1.0)
weasyprint PYPI version 62.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - documentsreader 1.1.5 - midastrader =1.0.1, =1.0.1, =1.0.7 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...
BIT-KIBANA-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...
BIT-ELK-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...
Malicious Package
Overview @umschool/analytics is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of t...
Kibana 9.1.x < 9.4.6 / 9.5.x < 9.5.2 Incorrect Authorization (ESA-2026-130)
The version of Kibana installed on the remote host is 9.1.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-130 advisory. - Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via...
Kibana 9.4.x < 9.4.6 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-122)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-122 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing...
MAL-2026-16051 Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
CVE-2026-86810
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...