Allocation of Resources Without Limits or Throttling

Overview org.apache.cxf:cxf-rt-frontend-jaxrs is an Apache CXF Runtime JAX-RS Frontend Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a default restriction on the number of form parameters in incoming messages. An attack...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +472 more potentially affected by CVE-2026-57819 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =4.0.0, =1.0.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 - com.codbex.kronos:codbex-kronos-components-api-parent 2.69.0 - com.codbex.kronos:codbex-kronos-components-engine-xsjob 2.69.0 -...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +2828 more potentially affected by CVE-2026-57819 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1, <=3.6.11)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =1.0.0, =1.11.0, =1.11.0, =1.9.0, =1.0.0, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-57819 Source advisory: MEND:CVE-2026-57819...

com.github.skjolber.xml-log-filter:xml-log-filter-jax-rs (2.0.1), com.norconex.crawler:nx-crawler-core (>=4.0.0-beta.1, <=4.0.0-beta.2) +161 more potentially affected by CVE-2026-57819 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =4.2.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =0.168, =10.0.2, =1.5.0, =1.5.0, =1.5.0, =1.7.0 and more Source cves: CVE-2026-57819 Source advisory: MEND:CVE-2026-57819...

CVE-2026-71434: Unrestricted Upload of File with Dangerous Type

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

CVE-2026-66662: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66470: Missing Authorization

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-68978

Impact Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public,...

PT-2026-68802

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2 Description Public frontend forms fail to enforce the file upload restrictions configured in the Control Panel. This allows an unauthenticated visitor to upload file types tha...

PT-2026-68578

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description An issue allows unauthenticated users to perform privilege escalation within the software. Recommendations Update to a version newer than 3.29.10...

PT-2026-68577

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description Broken access control exists within the subscriber role, allowing unauthorized access or actions within the administrative interface. Recommendations Update to a version newer...

Malicious Package

Overview tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, ther...

CVE-2026-70609

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...

cloud.piranha.dist:piranha-dist-micro (>=24.11.0, <=25.6.0), cloud.piranha.extension:piranha-extension-micro (>=24.11.0, <=25.6.0) +68 more potentially affected by CVE-2026-46581 via org.glassfish:jakarta.faces (>=4.0.23, <=4.1.12)

org.glassfish:jakarta.faces MAVEN version =4.0.23, =24.11.0, =24.11.0, =24.11.0, =24.11.0, =25.1.0, =5.0.0, =5.0.0, =1.5.15, =1.5.15, =1.5.15, =11.0.0, =6.12.0, =6.12.2 - org.apache.tomee.bom:tomee-plume-api 11.0.0-m1 - org.apache.tomee:apache-tomee 11.0.0-m1 and more Source cves: CVE-2026-46581...

Malware in devplatform-react-micro-frontend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Doan Dinh Van in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by okndjo in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

MAL-2026-12491 Malicious code in uploader-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911 The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username via...

Malicious code in uploader-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911 The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username via...

MAL-2026-12492 Malicious code in uploader-frontend-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681 The package's scripts.install runs node index.js, which loads lib/core.js and issues a dns.resolve4 query against a subdomain of oob.sl4x0.xyz...