CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333

The Lotus platform (through version 0.10.2 ) is susceptible to an improper authentication vulnerability within the Go event ingestion middleware . The root cause is that the middleware validates API keys based on the prefix only , failing to verify the secret against the stored hashed_key. An att...

EUVD-2026-108135

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Vo Duy Thang Dthangws in WordPress Plugin WP Event Solution versions = 4.1.26...

Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

PT-2026-121371

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability arises because the Go event ingestion middleware validates API keys solely by checking their prefix, without verifying the stored hashedkey. As a result, attackers can use the organization’s...

CVE-2026-114141

A flaw was found in toml. A remote attacker can trigger a Denial of Service DoS by supplying a crafted TOML document containing a large number of array-of-tables headers. Processing these unpruned headers causes repetitive path scanning that blocks the event loop, rendering the application...

CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...

curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)

Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...

Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

MAL-2026-18179 Malicious code in log-sink-testmetest (npm)

log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...

MAL-2026-18178 Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious code in event-emitter-testmetest (npm)

event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...

Malicious Package

Overview event-emitter-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Security Bulletin: IBM ApplinX is vulnerable to Improper Validation of Specified Quanitity in Input issue due to the use of source-map-js and @angular/router (CVE-2026-93749).

Summary A security vulnerability in source-map-js a transitive dependency via sass and @angular/router affects IBM ApplinX CVE-2026-93749. These packages are used in the ApplinX web framework front-end. IBM has issued fixes to resolve this vulnerability. The source-map-js version has been updated...

WordPress Modern Event Calendar Pro plugin < 7.37.0 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Wes Ring in WordPress Plugin Modern Events Calendar versions 7.37.0...