ff4j__ff4j_CVE-2022-44262_1-8-13

✨✨✨ FF4J - Feature Flipping for Java ✨✨✨ Codacy Badge FF4j, is an implementation of the Feature Toggle pattern. 🤘Features Feature Toggle: Enable. and disable features at runtime - no deployments. In your code implement multiple paths protected by dynamic predicates if/then/else. Role-based...

ff4j__ff4j_CVE-2022-44262_1_8_13_fixed

✨✨✨ FF4J - Feature Flipping for Java ✨✨✨ Codacy Badge FF4j, is an implementation of the Feature Toggle pattern. 🤘Features Feature Toggle: Enable. and disable features at runtime - no deployments. In your code implement multiple paths protected by dynamic predicates if/then/else. Role-based...

Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

GHSA-8XCJ-9HFR-FH9J Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

PT-2026-97048

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description An issue exists where the system authorizes the creation of a feature in a destination project but fails to verify if the user has access to the source project. Since feature names are globally uniqu...

EUVD-2026-81041

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

Malicious code in devplatform-spa-feature-toggle (npm)

Source: amazon-inspector 50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1 On require of the package, index.js loads bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hosts assembled via runtime string-splitting e.g...

Malicious code in devplatform-spa-plugin-s3-feature-toggle (npm)

Source: amazon-inspector 7574ec8653333519f651022c1d008eca37f884dc753ad8825cda3facdcd9aa61 On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from obfuscated Cloudflare Workers subdomains oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loads support.js, which builds three hardcoded origins under...

MAL-2026-13546 Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

Malicious Package

Overview tramvai-module-feature-toggle is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malware in tramvai-module-feature-toggle

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PYSEC-2026-2768 Open WebUI has an Indirect Object Reference (IDOR) in user notes

Summary The API /api/v1/notes/noteid endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. Details - if notes is...

PT-2026-59408

Summary The API /api/v1/notes/note id endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. Details - if notes is...

feature-toggle-manager (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-44546 via daphne (3.0.0)

daphne PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - feature-toggle-manager =0.0.1, =0.0.2 Source cves: CVE-2026-44546 Source advisory: OSV:GHSA-XH68-HFP5-5X5M...

feature-toggle-manager (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-44545 via daphne (3.0.0)

daphne PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - feature-toggle-manager =0.0.1, =0.0.2 Source cves: CVE-2026-44545 Source advisory: OSV:GHSA-RRC9-MX66-FFCM...

feature-toggle-manager (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-44545 via daphne (3.0.0)

daphne PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - feature-toggle-manager =0.0.1, =0.0.2 Source cves: CVE-2026-44545 Source advisory: OSV:PYSEC-2026-213...

feature-toggle-manager (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-44546 via daphne (3.0.0)

daphne PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on daphne and may be impacted: - feature-toggle-manager =0.0.1, =0.0.2 Source cves: CVE-2026-44546 Source advisory: OSV:PYSEC-2026-214...

CVE-2026-33380

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...