Malicious code in foodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s...

CVE-2026-71268

OpenPLC Runtime v3 is affected by a path traversal in compile_program() (webserver/openplc.py): it processes directives of the form (FILE:path content ) and writes to os.path.join('./core', file_path) without validating that file_path stays under ./core. A crafted ST file like (FILE:../../../etc/...

EUVD-2026-53353

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

EUVD-2026-53345

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx: The MailAccountViewSet.test() action can reuse stored credentials (IMAP password/OAuth token) from an existing account when a caller with object-level change_mailaccount permission redirects the test connection to an attacker-controlled IMAP host, causing exposure of real credentia...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

EUVD-2026-53317

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

Leaked n8n API Tokens Exposed Live Instances to Credential Theft

GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n...

MAL-2026-12180 Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

CVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-6627

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

CVE-2026-71207 Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded...

EUVD-2026-53204

The Stock-Inventory-Management-System application's login.php assigns raw $POST username/password values to $SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can...