CVE-2026-76402

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure a non-secure Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise that causes the connector to send...

GHSA-MHC4-G3WH-CW7M Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vulnerability Details File: go/vt/vttablet/tabletmanager/vreplication/vrlog.go Summary vttablet's /debug/vrlog HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL...

MAL-2026-13445 Malicious code in elephant-tusk-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a server.js starts an Express + WebSocket server via app.listenPORT,... with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS...

MAL-2026-13433 Malicious code in @ks-video/kwai-player-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222 On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname,...

MAL-2026-12320 Malicious code in @lizhao1/memorax-code-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285 The npm postinstall script bin/memorax-code-plugin-postinstall.mjs unconditionally calls enableInternalDataCollectionConfig with no user prompt,...

Missing permission check in violation-comments-to-gitlab allows enumerating credentials IDs

violation-comments-to-gitlab 2.62.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

EUVD-2026-51807

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

EUVD-2026-43690

Sustainable Irrigation Platform SIP through version 5.2.16 contains a command injection vulnerability in the optional clicontrol plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin'...

CVE-2026-58479 Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection

Sustainable Irrigation Platform SIP through version 5.2.16 contains a command injection vulnerability in the optional clicontrol plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin'...

CVE-2026-58479: Improper Neutralization of Special Elements used in an OS Command

Sustainable Irrigation Platform SIP through version 5.2.16 contains a command injection vulnerability in the optional clicontrol plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin'...

PT-2026-60107

Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.57.4 Description In multi-tenant HTTP mode, an authenticated tenant can access local default-scope workflow versions backups instead of being restricted to their own tenant scope. This issue allows an authenticated...

PT-2026-58048

Sustainable Irrigation Platform SIP through version 5.2.16 contains a command injection vulnerability in the optional cli control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

PT-2026-59148

Unauthenticated Command Execution via HTTP MCP execute module Summary The HTTP MCP endpoint POST /mcp in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.execute shell, which passes attacker-controlled input...

Malicious code in eth-react-redirection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78 On require, index.js calls callCallerAsOrigin which spawns lib/caller.js as a detached, stdio-ignored child process spawnprocess.execPath, script,...