CVE-2026-8590

CVE-2026-8590 affects Spotfire Enterprise (Server modules), Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes. It describes an OAuth2 PKCE bypass for public clients, with affected versions: Enterprise up to 14.0.12, 14.4.2, 14.5.0, 14.6.1–14.8.0; External Consumers up to 14....

Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

Security Bulletin: IBM Jazz Reporting Service is affected by RDF/XML parser of Apache Jena

Summary Apache Jena is used internally by IBM Jazz Reporting Service CVE-2022-28890. Apache Jena could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity XXE declarations by the RDF/XML parser. By sending a specially crafted request, a remo...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

Malicious code in relative-time-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ffd93ad946d5607c42e226106c1f1b33370e92e92cf0a407928b7349523fec4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sight-bind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10559 Malicious code in avatar-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79e52ebdc93b154163545b64642ea4c4016c4a69692c6f9e20e283cce3842770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10569 Malicious code in temp-cloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec75c040be8d9901d8715cc65309341f95b497d35062ea6014b7e4a36b35ff89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lusha-iam-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46142505b88a255674663ced6e8bce8c8f3e28c0936e463e07463a7e1331e5af package.json declares the node-fetch dependency pinned to a tarball URL on registry.ctzbg.com, a host unrelated to the npm registry and unrelated to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

CVE-2026-44747

creationtimestamp| type| source ---|---|--- 2026-07-14 00:54:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkymgc6gn2r 2026-07-14 02:27:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mql5t5mr6v2x 2026-07-14 03:00:30+00:00| seen|...

PT-2026-58082

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the...

PT-2026-58083

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

PT-2026-58032

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

CVE-2026-55002: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-14902: URL Redirection to Untrusted Site

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...

PT-2026-58219

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

PT-2026-58246

Name of the Vulnerable Software and Affected Versions SQL Server versions 2016 through 2025 Description An authorized attacker can elevate privileges locally due to external control of a file name or path. This allows an authenticated local user to gain administrative control over the database...

CVE-2026-9128: Unquoted Search Path or Element

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...