34514 matches found
CVE-2026-32616 Pigeon has a Host Header Injection in email verification flow
Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $SERVER'HTTPHOST' without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification lin...
MAL-2026-1421 Malicious code in devlino (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab9a10cdd7f1009bc1531da7299dc55e1a8ab63a76e1175becfff1dd629cf0f The package devlino was found to contain malicious code. Source: ghsa-malware e2d2201ff31202f25731c9699e97997f89ed857a82aa98a9feaa0ebe1243c45f Any...
Malicious code in devlino (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab9a10cdd7f1009bc1531da7299dc55e1a8ab63a76e1175becfff1dd629cf0f The package devlino was found to contain malicious code. Source: ghsa-malware e2d2201ff31202f25731c9699e97997f89ed857a82aa98a9feaa0ebe1243c45f Any...
Malicious code in cw-isdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae10c11f397ea01855bd467e8a77fc7f7ccb97477c54bfee0bae46cd5c324ca4 The package cw-isdk was found to contain malicious code. Source: ghsa-malware 54e686b27022344685c371190035a9586a04498a711c2456bdd9b5644c43c833 Any...
MAL-2026-1420 Malicious code in cw-isdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae10c11f397ea01855bd467e8a77fc7f7ccb97477c54bfee0bae46cd5c324ca4 The package cw-isdk was found to contain malicious code. Source: ghsa-malware 54e686b27022344685c371190035a9586a04498a711c2456bdd9b5644c43c833 Any...
CVE-2026-32361
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through = 3.9.0...
Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution
Veeam has released security updates to address multiple critical vulnerabilities in its Backup & Replication software that, if successfully exploited, could result in remote code execution. The vulnerabilities are as follows - CVE-2026-21666 CVSS score: 9.9 - A vulnerability that allows an...
Malicious code in f0-service-address-doctor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb126414f1575e7289915e4edd746dbac3d039a0a433f5069309acc281e7892 The package f0-service-address-doctor was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1378 Malicious code in f0-service-address-doctor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb126414f1575e7289915e4edd746dbac3d039a0a433f5069309acc281e7892 The package f0-service-address-doctor was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1377 Malicious code in adroit-websdk-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2635788b71e7d2d9a220ca0717bb46d6704bb205393b2f479105c20d9f94735e The package adroit-websdk-server was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in adroit-websdk-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2635788b71e7d2d9a220ca0717bb46d6704bb205393b2f479105c20d9f94735e The package adroit-websdk-server was found to contain malicious code. Source: ossf-package-analysis...
GHSA-4CM8-XPFV-JV6F ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
Summary The email channel authorizes senders based on the parsed From header identity only. If upstream email authentication/enforcement is weak for example, relaxed SPF/DKIM/DMARC handling, an attacker can spoof an allowlisted sender address and have the message treated as trusted input. Details...
EUVD-2026-11579
A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server...
EUVD-2026-11577
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository...
EUVD-2026-11574
A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server...
EUVD-2026-11576
A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server...
CVE-2026-21666
A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server...
CVE-2026-21669
A vulnerability allowing an authenticated domain user to perform remote code execution RCE on the Backup Server...