EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859: Server-Side Request Forgery (SSRF)

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

PT-2026-99479

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106 Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the...

PT-2026-99726

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.5 Description An authorization bypass exists in the admin-config-setup component within the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php. This issue allows a remote attacker to bypa...

PT-2026-99721

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description An improper access control issue exists in the packages/Webkul/Admin/src/Config/acl.php file. A remote attacker can execute a manipulation of an unknown function within this file to bypass...

CVE-2026-100885: Authorization Bypass Through User-Controlled Key

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100883: Improper Access Control

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

EUVD-2026-87762

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

PT-2026-99339

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.0 through 2.0.24 Description A Twig content sandbox escape exists where the array filter is included in the sandbox allowlist without the necessary needs is sandboxed guard. This allows the filter to call toArray or perform a...

CVE-2026-100418

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418

The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

Malicious Package

Overview @airbnb-extended/typescript-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview eslint-config-compact-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...