Langflow - Broken Access Control

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

CVE-2026-49049

CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler — Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...

CVE-2026-62989 Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access...

CVE-2026-62989 Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access...

CVE-2026-62989 Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access...

CVE-2026-62989

Prior to version 2.10.0 , the Shopper Headless e-commerce Admin Panel is vulnerable to an authorization bypass in the Variants Livewire component located at packages/admin/src/Livewire/Components/Products/Form/Variants.php. The root cause is a lack of server-side authorization for DeleteAction an...

EUVD-2026-100520

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-69703

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

CVE-2026-69703 Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

CVE-2026-69703 Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

Malicious code in ufish (PyPI)

Source: kam193 27371fa53e0e8e5e763b18b9bcadfd9b6991c720dd154d17bffeab0e7a139ef4 Versions 0.1.2, 0.1.3 were compromised. Compromised packages start an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kind...

Malicious code in spateo-release (PyPI)

Source: kam193 21400e8510d0663de6c3a4454fe99d9200cb83ae8d1ecdc137c99f3668da4293 Versions 1.1.2 were compromised. Compromised packages start an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of...

Malicious code in ray-mcp-server (PyPI)

Source: amazon-inspector 278bed91803e9a6775f966913bab49658f82a589e086ce8413782418a4bc4833 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 eae739a0cbe63099850e15e7ed9a72efd9d840d8cf003aa8c8dae1bb4c78a716 Versions 0.2.1 were...

Malicious code in orchestr8-platform (PyPI)

Source: amazon-inspector 7d9526ae43236ac15964b307175384455975ace26d8157ef3c41ed8db8192562 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 6b28e6bb345bcdb4726198079a56fcbbb0e73d4d2309c1927c0c8803d515232f Versions 3.3.2 were...

Malicious code in nucbox (PyPI)

Source: amazon-inspector 0357c6b685cea74f9200e3e7df019e807e34eac6518ec83f1a5a654c35d97959 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 e98ac1a9b5840905b608a09e8e66c73b750c0baa17d6b7789adfc94a8fd815e4 Versions 0.1.2, 0.1.3 were...

Malicious code in napari-ufish (PyPI)

Source: amazon-inspector 9785bcfea6c0bd6ff8193d721e15b2a80e4e718e16bd8722d018703bbd0b2516 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 5103d2b75fe554764a66f5e03957c303d4085a7d5133463f58aa0c83a87f5d7d Versions 0.0.2, 0.0.3 were...

Malicious code in mflux-streamlit (PyPI)

Source: amazon-inspector 9924feddaacd4b86934ddc7bdf8ff498921a80b34bf99a9136baa592fcc504b6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 27ef4c7f33e59dbe037d4b212286dd08cb7b1824c28c0032eb2d91db7a2b0174 Versions 0.0.3, 0.0.4 were...

Malicious code in mem8 (PyPI)

Source: amazon-inspector 5c765c6eef25d18c5a10057d62908ac3bc1ece86e39a9807683834fb7f896b52 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 d2fc000f15b66037b67d503cef346f32d400b0cc704417b28ff6c559c9924d8f Versions 6.0.1 were...

Malicious code in magique (PyPI)

Source: amazon-inspector b441b436c1f6aeba65c2af68c71655ed5aac95b0eb2ae4c402fc090c475ba887 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193 f5d3bf9e3bbd5c258d251ade5a15f3383a47a53ddd399d7cd3db2aee5cec45c4 Versions 0.6.8, 0.6.9 were...

Malicious code in hahabott (PyPI)

Source: kam193 89ed03d9e80d4ef62c54087a12177f795e478b1b5e5a8af69ef4e4740e102186 If run as module, it attempts to automatically destroy user's and system's files. Some versions also exfiltrate them. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...