Malicious code in events-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5482b17f0abd8f4ae8fed4fa5c53ea035a15b252efec406ae65dfe3365a7412 [email protected] impersonates the events EventEmitter polyfill README and Travis badge copied verbatim from browserify/events and ships a...

CVE-2026-34909

creationtimestamp| type| source ---|---|--- 2026-05-22 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116617053903196416 2026-05-22 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmgg2g4mix26 2026-05-26 09:13:20+00:00| seen|...

Concrete CMS is vulnerable to authorization bypass in the Calendar Block

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed...

CVE-2026-8205

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8205

Concrete CMS

CVE-2026-8205

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-28910

creationtimestamp| type| source ---|---|--- 2026-05-21 17:47:19+00:00| seen| https://infosec.exchange/users/alexandreborges/statuses/116613816857863838 2026-05-21 17:47:29+00:00| seen| https://bsky.app/profile/alexandreborges.bsky.social/post/3mmexyl75a22g 2026-05-22 04:40:06+00:00| seen|...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to stream corruption in Spring MVC and WebFlux [CVE-2026-22735]

Summary IBM Watson Speech Services Cartridge is vulnerable to stream corruption in Spring MVC and WebFlux when using Server-Sent Events SSE CVE-2026-22735. Spring MVC and WebFlux are used in our speech microservices. This vulnerabilitiy has been addressed. Please read the details for remediation...

CVE-2026-9141

creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsfgqmlg2k 2026-05-21 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmdbhrxmv52l 2026-05-21 01:30:33+00:00| seen|...

CVE-2025-32750

creationtimestamp| type| source ---|---|--- 2026-05-20 17:56:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmci4r6pzr2q 2026-05-20 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcp25o5552e...

CVE-2026-42462

creationtimestamp| type| source ---|---|--- 2026-05-20 17:38:59+00:00| seen| https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mmcgyic3lig2 2026-05-20 18:10:13+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mmcinnvfjdd2 2026-05-21 02:33:02+00:00| seen|...

Missing Authentication for Critical Function

Overview symfony/twilio-notifier is a Symfony Twilio Notifier Bridge Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the doParse webhook request parser in the notifier bridge. An attacker can submit forged webhook status events because the pars...

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

Summary The SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a...

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

Summary The SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553" — a Go http.Server.Addr of ":5553" listens on every interface. On...

CVE-2026-45070

creationtimestamp| type| source ---|---|--- 2026-05-20 13:37:36+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbzn2gy7z2m 2026-05-20 14:15:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qc4eg22q 2026-07-14 19:58:43+00:00| seen|...

CVE-2026-8469 Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenixstorybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.toatom/1 without...

CVE-2026-47783

creationtimestamp| type| source ---|---|--- 2026-05-20 11:52:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmbtqvnqvt2k 2026-05-21 23:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmfllxhfro2s...

CVE-2026-47212

creationtimestamp| type| source ---|---|--- 2026-05-20 11:02:20+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbqxgdjg72y 2026-05-20 14:15:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qc4eg22q...