49434 matches found
Missing Authorization
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization in the actionGetNewUsersData process. An attacker can access aggregate user registration metrics by sending POST requests to the /actions/charts/get-new-users-data...
EUVD-2026-54167
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
CVE-2026-48085
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...
CVE-2026-66708
creationtimestamp| type| source ---|---|--- 2026-08-06 21:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgwruxti62t...
CVE-2026-71476
creationtimestamp| type| source ---|---|--- 2026-08-06 20:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgwbqkenv23...
CVE-2026-18258
creationtimestamp| type| source ---|---|--- 2026-08-06 20:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgtg7o27v2t...
Malicious code in vite-plugin-cleaner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...
Malicious code in wormgpt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...
MAL-2026-13466 Malicious code in wormgpt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...
CVE-2026-33930
creationtimestamp| type| source ---|---|--- 2026-08-06 18:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgn2qtzic2r...
CVE-2026-13342 Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...
CVE-2026-13342 Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...
CVE-2026-13342
CVE-2026-13342 affects the Security Optimizer WordPress plugin (versions 1.5.8–1.6.4). The IP-based login restriction can be bypassed due to improper validation, allowing unauthenticated requests from non-allowlisted IPs to access the login form. Impact: defeats administrator-configured access co...
CVE-2026-58158
creationtimestamp| type| source ---|---|--- 2026-08-06 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgjpi53yw2r...
Malicious code in aitable-workflow-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host...
MAL-2026-13448 Malicious code in lib-frontsga (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...
CVE-2026-18277
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...