158787 matches found
CVE-2026-22331
Unauthenticated Local File Inclusion in AutoParts = 1.5.8 versions...
CVE-2026-22328
Unauthenticated Cross Site Scripting XSS in Auto Repair = 22.6 versions...
openvpn-connect-echo-script-ace-poc
OpenVPN Connect Server-Pushed Option Findings PoC Benign proo...
CVE-2026-22328 WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Auto Repair = 22.6 versions...
CVE-2026-22328
CVE-2026-22328 corresponds to a reflected XSS in WordPress Theme Auto Repair <= 22.6, described as unauthenticated in the Initial description and reflected XSS in the product detail. CVSS shows Network attack vector, no privileges required, low impact to confidentiality/integrity/availability,...
Malicious code in speed4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766e347295e7a13e0604a89de30f662a24b690598f1e4b01edaac5400178347 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...
MAL-2026-5938 Malicious code in speed4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766e347295e7a13e0604a89de30f662a24b690598f1e4b01edaac5400178347 [email protected] is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker importScripts'./8cfc2/hgshm.js...
opencode-apk-forge
APKForge - The Dark Version of OpenCode ███╗ ███╗ ██╗...
Malicious code in nottuff25 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...
MAL-2026-5916 Malicious code in nottuff25 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 238a4f56f3433bf34de372e9a26264a33e33c6bde8592ddc73594d33ab7427f0 The tarball is not a Node library. package.json declares main: sw.js with description "package" and an empty author; sw.js is a browser ServiceWorker...
Malicious code in nottuff15 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea629a411d1555cb4dbc80aa218539333aefce15e110ad0a5eaa16e4a58ab5f3 nottuff15 is one entry in a coordinated npm namespace-spam campaign. The tarball ships auto-publish.sh, a bash script that copies the package content...
PT-2026-49093
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5 Description Insecure deserialization occurs in glances/outdated.py because the load cache function uses pickle.load to read a version-check cache file. This file is stored at predictable, world-accessible paths...
GHSA-99F4-GRH7-6PCQ vulnerabilities
Vulnerabilities for packages: kibana, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, gemini-cli, cadence-web, pulumi, langfuse, langfuse-fips...
CVE-2026-48069 vulnerabilities
Vulnerabilities for packages: kibana, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, gemini-cli, cadence-web, pulumi, langfuse, langfuse-fips...
CVE-2026-48068 vulnerabilities
Vulnerabilities for packages: kibana, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, gemini-cli, cadence-web, pulumi, langfuse, langfuse-fips...
CVE-2026-47189
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command is executed. A user can learn a victim...
CVE-2026-47163 Quest Bot: Unprivileged users can create and remove AutoMod rules.
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runti...
CVE-2026-47169 Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the select...
CVE-2026-47169 Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the select...
CVE-2026-47169
CVE-2026-47169 affects Quest Bot (Discord bot). Before v1.0.3, a user with Manage Server/ManageGuild but without Manage Roles or Admin can abuse AutoRole to grant an Administrator role to a new member if the role is below the bot’s highest role. This can lead to a controlled account gaining full ...