CVE-2026-65543

CVE-2026-65543 affects the WordPress Vimeo plugin (versions ≤ 1.2.2). The vulnerability is described as Subscriber Sensitive Data Exposure, with CVSS v3.1 Base Score 7.5 (HIGH) and an attack vector of NETWORK, requiring no privileges and no user interaction. The root cause and affected components...

EUVD-2026-53973

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

EUVD-2026-53947

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

CVE-2026-28169

CVE-2026-28169 concerns unauthenticated sensitive data exposure in the WordPress plugin YITH WooCommerce Zoom Magnifier (versions

CVE-2026-58043

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories. Mitigation Avoid enabling the Node.js Permission Model by not using the --permission flag when starting Node.js applications. This...

EUVD-2026-53933

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

CVE-2026-70637 LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

CVE-2026-70637

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

CVE-2026-70637

LightFTP 2.4 contains data race vulnerabilities in ftpserv.c allowing anonymous attackers to trigger undefined behavior by issuing LIST followed by ABOR without authentication. The control thread may close data_socket and file_fd descriptors while worker threads concurrently access the same field...

Azure Service Bus Remote Code Execution Vulnerability

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

Malicious code in @activepieces/piece-google-bigquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3 The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require"childprocess", an OS reconnaissance...

Malicious code in @activepieces/piece-google-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...

MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

MAL-2026-13403 Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

CVE-2026-67305

The FreeRDP Windows client contains a heap buffer overflow vulnerability. If a user pastes maliciously crafted, oversized clipboard data from an untrusted RDP server, it triggers memory corruption that may result in remote code execution...

CVE-2026-68579

A flaw was found in FreeRDP. A heap-based buffer overflow exists in the Windows clipboard client's CliprdrStreamRead function. A malicious or compromised Remote Desktop Protocol RDP server can send an oversized clipboard file contents response. When a user pastes this content, it causes an...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

EUVD-2026-53857

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...