14020 matches found
Malicious code in bpm-foundation-feature-flags (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a163a3ddfdfdb76a6ce2348a4876322cc9ff6280537d7fde9edecabfcb68120 The package's main entry requires./compat on load, which runs a bootstrap routine that fetches a platform-specific binary from hardcoded Cloudflare...
CVE-2026-71246 Pixelfed: Authenticated SSRF via Remote URL Search
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...
phpVMS < 7.0.6 - Legacy Importer Authorization Bypass
phpVMS 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges. id: CVE-2026-42569 info: name: phpVMS 7.0.6 - Legacy Importer Authorization Bypass...
CVE-2026-18907
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...
CVE-2026-18907
CVE-2026-18907 describes a path traversal vulnerability in the Android app com.talpa.hibrowser (version 2.23.1.1) where the Download File feature allows arbitrary file writes via directory traversal sequences in the filename. Affected component: Download File feature; Root cause: improper sanitiz...
EUVD-2026-53021
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...
CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...
CVE-2026-69252
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...
Malicious code in @servicetitan/feature-spotlight (npm)
npm/@servicetitan/feature-spotlight is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11867 Malicious code in @servicetitan/feature-spotlight (npm)
npm/@servicetitan/feature-spotlight is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/standalone-feature-flags (npm)
npm/@servicetitan/standalone-feature-flags is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...
MAL-2026-11919 Malicious code in @servicetitan/standalone-feature-flags (npm)
npm/@servicetitan/standalone-feature-flags is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...
EUVD-2026-52514
Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...
CVE-2026-48399
Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...
CVE-2026-48399 Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)
Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...
CVE-2026-48399
Technical details about CVE-2026-48399 are not publicly available in the provided documents. Monitor for updates from official advisories to assess impact, affected products, and remediation.
CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...
CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...