CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

MAL-2026-13432 Malicious code in @junyoung-kim/reins (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f53adf4aaeaffcb1bf0698a8fcb748f12522321b24cf44802d0b9f1b441475 The reins CLI spawns a local pseudo-terminal via node-pty default /bin/bash or cmd.exe and bridges it bidirectionally to a hardcoded WebSocket endpoi...

CLSA-2026-1786034295 curl: Fix of CVE-2026-8932

CVE-2026-8932: authentication bypass through connection reuse, where the client certificate type, private key, key type and key password were not part of the SSL configuration compared by Curlsslconfigmatches, so an easy handle could inherit another handle's authenticated mTLS connection...

CLSA-2026-1786034027 curl: Fix of CVE-2026-8932

CVE-2026-8932: authentication bypass through connection reuse, where the client certificate type, private key, key type and key password were not part of the SSL configuration compared by Curlsslconfigmatches, so an easy handle could inherit another handle's authenticated mTLS connection...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

Malicious code in vitest-preview-pro-all (npm)

Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier stri...

Malicious code in helmet-pro (npm)

Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawns lib/utils/smtp-connection/index.js as a detached child...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

EUVD-2026-54094

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-5423

The CVE affects @neo4j/graphql library prior to 7.5.6 (and 7.5.x) where a pre-decoded JWT passed via GraphQL subscription connectionParams is not verified, allowing unauthenticated clients to forge JWT claims and trigger @authentication/@subscriptionsAuthorization checks to receive restricted sub...

CLSA-2026-1786026662 curl: Fix of 2 CVEs

CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state - CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache...

MAL-2026-13418 Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

Malicious code in tsihealth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218 index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and evals the result a...

CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager: established connections are resolved by a two-byte local connection handle without verifying the datagram source against the registered remote address. An on-path attacker observi...