CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

UBUNTU-CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

EUVD-2026-92819

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-105693

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

CVE-2026-105693

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

CVE-2026-105693

The open-source design and prototyping platform Penpot is vulnerable to an anonymous share-link token disclosure and page-scope bypass in versions prior to 2.18.0 . The unauthenticated get-view-only-bundle RPC incorrectly returns every share-link row for a file, even when a caller authenticates w...

CVE-2026-105693 Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

EUVD-2026-92712

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

Malicious code in hardhat-kex (npm)

Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry table and numeric-dispatch wrapper, containing exec string...

Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

MAL-2026-17559 Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

CVE-2026-105693: Missing Authorization

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

PT-2026-106214

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the unauthenticated get-view-only-bundle RPC Remote Procedure Call that returns all share-link rows for a file, regardless of whether the caller authenticated with a single scoped...

CVE-2026-94239

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

EUVD-2026-91948

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-94239 Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...