Malicious code in create-react-app-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ce3734765ee6802d3ccdbbecb091f613417a1ff055ee8fb75ced9f7cf36ef31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14326 Malicious code in create-react-app-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ce3734765ee6802d3ccdbbecb091f613417a1ff055ee8fb75ced9f7cf36ef31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14324 Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in create-react-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ad9d14917da2cd3e79a2885cdb25d2009133fb55f9ed4bead87e677f64f7816 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14325 Malicious code in create-react-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ad9d14917da2cd3e79a2885cdb25d2009133fb55f9ed4bead87e677f64f7816 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-78929

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 Description A credential validation bypass exists in the MCP create workflow from code tool when the authentication type is configured as an expression. An attacker possessing a valid MCP Bearer API key and a targe...

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

Insufficient Logging

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...

CVE-2026-76208: Insufficient Logging

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

PT-2026-76952

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced runid vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099479 advisory. Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

PT-2026-76761

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.32.0 Description The page module's move operation fails to enforce the create permission of the destination parent. This occurs because the oldParent archive condition disables the check for ordinary moves...

PT-2026-76678

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /create project endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may ...

CVE-2026-50768: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...