Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk delete process. An attacker can gain unauthorized access to and modify or disable accounts outside their permitt...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

EUVD-2026-70985

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85540

DreamMaker , a product developed by Interinfo , is affected by a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability is rated HIGH with a CVSS v3.1 base score of 8.8 (network vector, low com...

CVE-2026-85546

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85538

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...

Malicious code in damp_mastodon_z3n (npm)

Source: amazon-inspector 6f2df8daa9eeb978900364311c5650623cea28ab641e7d799578e059250bad77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in damaged_cicada_z3n (npm)

Source: amazon-inspector 22affea8e9e28bdded80d46ced1cc20794da2eb61609700e73439d2bfc747de6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in damaged_dragon_0xrequest (npm)

Source: amazon-inspector 153ff4f395f35a50a7066b01618b65abdab5126f1efb8026476cf383dcec4fe1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in damaged_rat_z3n (npm)

Source: amazon-inspector f0cbe942f8b1ce6077f117047b0be6e58052938cebdd7714b024adc4e93b25df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-trefddua-tazc12 (npm)

Source: amazon-inspector 4842cf4b8cb644cacc06dcad549741387482845301444bfc71d4f2fc09a6596c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-treua-tazc12 (npm)

Source: amazon-inspector 969e5bd440734c14899b862bee49d851fac31af4074570cbd5740ab5e2004689 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dakruz (npm)

Source: amazon-inspector ca211a3287b5cd835f3a7357bdc91092dc80d87a90bb22f7b6eb6feeb08d96b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-tffdd-tazc12 (npm)

Source: amazon-inspector 82bbca37579e25f8e67db8db5f97c9330c60c22d5efa38407dec2c107fe07870 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-tffd-tazc12 (npm)

Source: amazon-inspector f10f96e8ab8d779fd6c9a5f964ac461088cbec11d5945eec3fbb75b4fd632236 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-tadfaa-ta12 (npm)

Source: amazon-inspector 136e22c53e142bebfc478a8b9c41e1e6e62b9630eb02de9d035e5c8f4c168c16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-ssaa-t13a (npm)

Source: amazon-inspector e498a2fee9e1fea8b7c9745125f513b6833d091922af435a8ddf5d294a580c6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-tdua-tazc12 (npm)

Source: amazon-inspector a9f0944d48bc92a95141b3e9ed8d1b566e046154b8bd95380dcfbfc67d01a5f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dajouka-tfsfcdd-tazc12 (npm)

Source: amazon-inspector 1ee0e4cac6f09be231f160aa4ccdcd2a1d1e6a5fc0bc8bff262bc89f1cc2a279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...