EUVD-2025-210830

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

PT-2026-84711

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485: Missing Authorization

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

MAL-2026-15819 Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

CVE-2026-82834: Improper Access Control

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component...

GHSA-MF7Q-R4RV-JV94 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready-fips, crossplane-function-auto-ready...

WordPress NextScripts: Social Networks Auto-Poster plugin < 4.4.8 - Reflected XSS via Facebook OAuth Callback vulnerability

Reflected XSS via Facebook OAuth Callback vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NextScripts versions 4.4.8...

Linux Distros Unpatched Vulnerability : CVE-2026-81523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted witho...

DEBIAN-CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

UBUNTU-CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

EUVD-2026-67207

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

PT-2026-82596

openssl encrypt versions before 1.4.9 fail to escape attacker-controlled key id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key id containing escape sequences to repaint terminal output and forge authenticity verification blocks...

MAL-2026-14533 Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

SUSE CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...