CVE-2026-67236: Cleartext Storage of Sensitive Information

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-97230

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

Fedora 43 : mongo-c-driver (2026-f74926c622)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f74926c622 advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

CVE-2026-95831

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-95831: Embedded Malicious Code

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-36471

Deserialization of Untrusted Data of the postdata parameter in cnparseurl in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables including referer via a crafted base64-encoded serialized PHP payload submitted as a POST parameter...

Malicious code in chai-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL...

CVE-2026-2422

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

CVE-2026-2422: Improper Neutralization of Input During Web Page Generation

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

PT-2026-95819

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bdd Description The software writes Model Context Protocol MCP authentication tokens, which are passed via URL query parameters, into plaintext application logs without redaction. This allows attackers w...

MAL-2026-16293 Malicious code in chai-as-indexed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd158a05893a55a82bee4867772aefbfb3199a443c38e7161db1a71d47ced86 chai-as-indexed presents itself as a pino-compatible logger package.json keywords fast/logger/stream/json, exports module.exports.pino, lib/ filename...

CVE-2026-77385

Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...