3303 matches found
CVE-2026-100681: Server-Side Request Forgery (SSRF)
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...
CVE-2026-93984
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
EUVD-2026-83589
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
PT-2026-95742
Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.34 Description The plugin is subject to information exposure through spoofing. The is ai bot user function identifies privileged internal AI bot...
PT-2026-95821
Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994 Description The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing on...
CVE-2026-93984: Improper Authentication
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...
fennel (0.3.0), runnel (>=0.1.0a2, <=0.1.0b1) +1 more potentially affected by CVE-2026-64847 via anyio (3.0.0rc4)
anyio PYPI version 3.0.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - fennel 0.3.0 - runnel =0.1.0a2, =0.8.0, =0.13.0 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...
python-webex-bot (0.51.0) potentially affected by CVE-2026-102930 via virtualenv (16.4.3)
virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...
python-webex-bot (0.51.0) potentially affected by CVE-2026-102937 via virtualenv (16.4.3)
virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...
invisible_playwright v0.20.0
Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...
CVE-2026-90999
creationtimestamp| type| source ---|---|--- 2026-09-17 14:13:11+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mvptl5corp2h 2026-09-17 16:39:32+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3mvq3qtl4v72r 2026-09-18 14:50:04+00:00| seen|...
Malicious code in discord-resolvers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...
MAL-2026-16214 Malicious code in discord-resolvers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...
MAL-2026-16213 Malicious code in discord-players (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2 index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd excluding...
CVE-2026-57122
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...
CVE-2026-57122 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...
EUVD-2026-77599
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...