CVE-2026-23525 1panel App Store vulnerable to Cross-site Scripting

1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting XSS vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data...

EUVD-2026-3193

1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting XSS vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data...

CVE-2026-23525

CVE-2026-23525 affects 1Panel, a web-based Linux server management panel. The stored XSS vulnerability originates from insufficient sanitization in the MdEditor component (previewOnly) used to render App Store and related content, allowing malicious scripts to run in the user’s browser and potent...

CVE-2026-23525

1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting XSS vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data...

PT-2026-3400

Name of the Vulnerable Software and Affected Versions 1Panel versions through 1.10.33-lts 1Panel versions through 2.0.16 Description 1Panel is a web-based control panel for Linux server management. A stored Cross-Site Scripting XSS issue exists in the 1Panel App Store when viewing application...

US Hackers Reportedly Caused a Blackout in Venezuela

Plus: AI reportedly caused ICE to send agents into the field without training, Palantir’s app for targeting immigrants gets exposed, and more...

EUVD-2026-3149

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

CVE-2021-47827

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field,...

CVE-2021-47831

CVE-2021-47831 affects Sandboxie 5.49.7. The issue is a denial of service vulnerability where the application can crash by overflowing the Sandbox container folder input field; an attacker can paste a large buffer of repeated characters into this field to trigger the crash. Metrics show CVSSv4.0 ...

CVE-2021-47827 WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field,...

Exploit for CVE-2026-46368

OpenWrt luci-app-https-dns-proxy Authenticated Command Injecti...

CVE-2025-43508

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data...

Malicious Package

Overview lusha-micro-app-messages is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-0696

creationtimestamp| type| source ---|---|--- 2026-01-16 16:00:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mckhrqss272r 2026-01-19 22:54:28+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mcsqdewbwk2x...

CVE-2026-0916

creationtimestamp| type| source ---|---|--- 2026-01-16 07:58:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcjmv5od552o 2026-01-16 10:20:41+00:00| seen| https://gist.github.com/Darkcrai86/22fb76d7c4430b091a4b83d7dc51a87c...

Malicious code in lusha-micro-app-messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2763ac2e60a783720a4825cd416a2c3e991ab820c9a11c72d809c5162eb822 The package lusha-micro-app-messages was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-3066

Malicious code in lusha-micro-app-messages npm...

MAL-2026-293 Malicious code in lusha-micro-app-messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2763ac2e60a783720a4825cd416a2c3e991ab820c9a11c72d809c5162eb822 The package lusha-micro-app-messages was found to contain malicious code. Source: ghsa-malware...

PT-2026-3261

Name of the Vulnerable Software and Affected Versions Dive versions prior to 0.13.0 Description Dive is an open-source MCP Host Desktop Application that integrates with function-calling LLMs. A crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user...

Markdownify security vulnerabilities

Markdownify is a minimal Markdown editor desktop application built using Electron by Amit Merchant as a personal development project. Version 1.2.0 of Markdownify contains a security vulnerability; this vulnerability stems from stored cross-site scripting in markdown files, which could lead to...