Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

CVE-2026-3940

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

BeatBanker Android Trojan Uses Silent Audio Loop to Steal Crypto

BeatBanker Android Trojan spreads via fake Google Play Store pages, using a silent audio loop to stay active while stealing crypto, banking data, and login credentials...

CVE-2026-2358

The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wpulikelikersbox shortcode template attribute in all versions up to, and including, 5.0.1. This is due to the use of htmlentitydecode on shortcode attributes without subsequent output sanitization, which...

CVE-2025-67035

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys,...

CVE-2025-67039

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username...

CVE-2025-67039

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username...

CVE-2026-3862 Cross-Site Scripting Vulnerability in SiteMinder Administrative UI

Cross-site Scripting XSS allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, kubernetes-dashboard-web, docker-cli, rancher-helm, cerbos, snyk-cli, restic, kube-arangodb, fuse-overlayfs-snapshotter, rancher-agent, terraform-provider-kubernetes, blob-csi, cluster-api-gcp-controller, gitness, oauth2-proxy, temporal-server...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, kubernetes-dashboard-web, docker-cli, rancher-helm, cerbos, snyk-cli, restic, kube-arangodb, fuse-overlayfs-snapshotter, rancher-agent, terraform-provider-kubernetes, blob-csi, cluster-api-gcp-controller, gitness, oauth2-proxy, temporal-server...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, vale, terraform-provider-kubernetes, rabbitmq-messaging-topology-operator, temporal-server, kube-bench, sriov-network-device-plugin, crossplane-provider-aws-elasticache, spire-controller-manager, gitlab-pages, stakater-reloader,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, vale, terraform-provider-kubernetes, rabbitmq-messaging-topology-operator, temporal-server, kube-bench, sriov-network-device-plugin, crossplane-provider-aws-elasticache, spire-controller-manager, gitlab-pages, stakater-reloader,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: openbao-k8s, pguser, snyk-cli, vale, terraform-provider-kubernetes, rabbitmq-messaging-topology-operator, temporal-server, kube-bench, sriov-network-device-plugin, crossplane-provider-aws-elasticache, spire-controller-manager, gitlab-pages, stakater-reloader,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: kong-ingress-controller, aws-nuke, kots, ko-fips, localstack, crossplane-provider-aws-efs, prometheus-node-exporter-fips, crane-fips, cloud-sql-proxy, victoriametrics-operator, kyverno, emqx-exporter-fips, seaweedfs-operator, beats-fips, maru, chronyexporter,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kong-ingress-controller, kots, ko-fips, localstack, crossplane-provider-aws-efs, prometheus-node-exporter-fips, cloud-sql-proxy, kyverno, emqx-exporter-fips, seaweedfs-operator, beats-fips, chronyexporter, json-exporter-fips, crossplane-provider-aws-kinesis,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: kong-ingress-controller, aws-nuke, kots, ko-fips, localstack, crossplane-provider-aws-efs, prometheus-node-exporter-fips, crane-fips, cloud-sql-proxy, victoriametrics-operator, kyverno, emqx-exporter-fips, seaweedfs-operator, beats-fips, maru, chronyexporter,...

MAL-2026-1313 Malicious code in iron-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa0828e4b92294651d9b815203d5e2e7cbe45cce351dfa340bb6a79481a4a0cd The package iron-pages was found to contain malicious code. Source: ghsa-malware ec5456f01c9dadf3a140d1cd4974007405b2fdf1a9f1639c264a194555229ec4 Any...

Malicious Package

Overview iron-pages is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in iron-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa0828e4b92294651d9b815203d5e2e7cbe45cce351dfa340bb6a79481a4a0cd The package iron-pages was found to contain malicious code. Source: ghsa-malware ec5456f01c9dadf3a140d1cd4974007405b2fdf1a9f1639c264a194555229ec4 Any...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome, which can be exploited by attackers to disclose cross-domain data via specially crafted HTML pages...