Malicious Package

Overview @biz44/id79-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id12-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/id44-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview id79-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2026-12667

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited...

CVE-2026-91961

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send a Universal Serial Bus USB Redirection for Remote Desktop Connection URBDRC control-transfer request with an invalid OutputBufferSize. This can trigger an assertion in the client process, leading to a denial of...

CVE-2026-11728 IBM MQ .NET client is vulnerable to remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in t...

CVE-2026-56829 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56829

Shopper (a headless e-commerce admin panel) prior to 2.9.2 has an authorization bypass in the Livewire VariantStock component. The stockAction() method lacks an edit_product_variants permission check, and the public $variant property is missing the #[Locked] attribute, making it client-mutable vi...

CVE-2026-56825

Shopper (a headless e-commerce admin panel) is vulnerable to an authorization bypass in the CollectionProducts Livewire component prior to v2.9.2 . Two defects combine: the per-record and bulk delete actions lack an ->authorize(...) guard, and the public $collection property is not marked #[Lo...

CVE-2026-11729 IBM MQ Java messaging is vulnerable to remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe...

CVE-2026-12667 IBM MQ .NET client is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited...

CVE-2026-12667

IBM MQ .NET client is vulnerable to XML External Entity (XXE) injection (CWE-611) in its RFH2 message parser . An authenticated attacker can read files from a vulnerable .NET client or cause limited denial of service. Affected versions span 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 L...

EUVD-2026-78872

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

EUVD-2026-78930

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-91964

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...

DEBIAN-CVE-2026-91961

FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a...

DEBIAN-CVE-2026-91954

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdisurfacebits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabl...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...