Grafana - Exposes DingDing API Keys

An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...

CVE-2026-108868

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108883

The JeecgBoot framework (versions through 3.9.5 ) contains a missing authorization vulnerability in the editThirdAppConfig handler. This flaw allows any authenticated user to modify configurations for third-party applications, specifically DingTalk , WeCom , or Feishu integrations. A low-privileg...

EUVD-2026-97057

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or...

CVE-2026-108883 JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or...

CVE-2026-108868

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability (CWE-862) accessible via the POST /sys/api/sendBusTemplateAnnouncement endpoint. This flaw allows any authenticated user to publish templated system announcements. A low-privileged attacker can provide specific...

CVE-2026-108869

The JeecgBoot framework (versions through 3.9.5 ) is vulnerable to a missing authorization flaw in the POST /sys/api/sendSysAnnouncement endpoint. This allows low-privileged authenticated users to send forged system announcements to any user. Attackers can provide arbitrary values for the title ,...

EUVD-2026-97042

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

BIT-APISIX-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220

A Cross-Site request forgery (CSRF) vulnerability exists in the feishu-auth and dingtalk-auth plugins within Apache APISIX (versions 3.17.0 through 3.18.0 ). This flaw allows an attacker to trick a user into clicking a crafted link, causing the user's browser session on a protected route to be es...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

EUVD-2026-90766

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

PT-2026-103832

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description Cross-Site Request Forgery CSRF exists in the feishu-auth and dingtalk-auth plugins. An attacker can trick a user into clicking a crafted link, causing the user's browser session on a...

CVE-2026-94220: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

Malicious code in nepublisher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc0d0609f88630f7ce36adf18c70a1d6bd3d64aaaa059a3b8ec9b97b813705a On npm install, lib/init.js spawns a detached Node child process that collects host identifiers hostname, username, cwd, IPv4 addresses, Node version...

MAL-2026-5984 Malicious code in nepublisher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc0d0609f88630f7ce36adf18c70a1d6bd3d64aaaa059a3b8ec9b97b813705a On npm install, lib/init.js spawns a detached Node child process that collects host identifiers hostname, username, cwd, IPv4 addresses, Node version...