CVE-2026-48039

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

EUVD-2026-54616

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48097

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

EUVD-2026-54603

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

MAL-2026-13620 Malicious code in @catamania/front-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...

Malicious code in @catamania/front-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...

CVE-2026-19264

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-13599 Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in ded-pwa-c-boxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

EUVD-2026-54420

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...