Malicious Package

Overview chat-adapter-matrix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

EUVD-2026-84121

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-73511

Envoy (open source edge and service proxy) contains a path-matching/authentication bypass in versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is a mismatch in how per-segment matrix parameters (semicolon-delimited) are handled: Envoy matches the raw request path, while servl...

CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-94277 Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

MISP's galaxy matrix statistics view app/View/Users/statisticsgalaxymatrix.ctp renders the galaxy name directly into HTML output via sprintf without any HTML encoding. An authenticated user holding the permgalaxyeditor permission can create or modify a galaxy whose name contains arbitrary HTML or...

CVE-2026-94277 Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

MISP's galaxy matrix statistics view app/View/Users/statisticsgalaxymatrix.ctp renders the galaxy name directly into HTML output via sprintf without any HTML encoding. An authenticated user holding the permgalaxyeditor permission can create or modify a galaxy whose name contains arbitrary HTML or...

CVE-2026-94277

CVE-2026-94277 is a stored cross-site scripting (XSS) vulnerability in MISP versions below 2.5.47 . The affected component is the galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp), where the galaxy name is interpolated into HTML output via sprintf() without HTML encoding....

Malicious code in chat-adapter-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

MAL-2026-16308 Malicious code in chat-adapter-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...

PT-2026-96065

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The galaxy matrix statistics view app/View/Users/statistics galaxymatrix.ctp renders the galaxy name directly into HTML output using the sprintf function without proper HTML encoding. An authenticated...

CVE-2026-73511: Authentication Bypass by Alternate Name

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

PT-2026-96293

Name of the Vulnerable Software and Affected Versions FalkorDB Redis module versions 4.20.1 through 4.20.4 Description A buffer overflow exists in the Decode GrB Matrix function located in /v19/decode matrix.c. This flaw allows an attacker to trigger a Denial of Service DoS by providing a special...

EUVD-2026-81289

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589

Craft CMS versions 5.0.0 through 5.10.12 contain a broken access control flaw in the actions/nested-elements/reorder endpoint. Unlike the corresponding delete endpoint, this endpoint trusts the manageNestedElements::::field: session flag alone and never rechecks the caller's savePeerEntries permi...