Malicious code in cdp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf55b093e3a93e8d3f536101e62e09cf7e86636cd42813d02f518138cbcb8ed The package ships cdpinject.js, which combines childprocess, fs, http/https, and base64 encoding to gather system information and exfiltrate it over...

CVE-2026-6811

creationtimestamp| type| source ---|---|--- 2026-05-15 02:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlubaimv242n...

CVE-2026-8612

creationtimestamp| type| source ---|---|--- 2026-05-15 02:05:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mluam7kbww2b...

CVE-2026-31233

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

Quantum Futures Interactive: A Live Demonstration of Post-Quantum Blockchain Security, Infrastructure Tradeoffs, and Sustainable Distributed Trust

Advances in quantum computing introduce long-term security challenges for widely deployed public-key cryptographic systems used across blockchain platforms and decentralized applications. Although post-quantum cryptography PQC standards are emerging, understanding quantum risk remains fragmented...

PT-2026-41274

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.28.37 Description Insufficient authorization checks in the role field update mechanism and overly permissive capabilities for the admin form post type allow for privilege escalation. The admin...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. Versions of Mattermost such as 11.5.1 and earlier, as well as 10.11.13 and earlier, have security vulnerabilities. These vulnerabilities stem from the lack of enforcement of the PostEditTimeLimit for...

APM – Agent Package Manager 后置链接漏洞

APM – Agent Package Manager is an open-source AI-based dependency management tool developed by Microsoft. In versions 0.5.4 to 0.12.4 of APM, there was a post-link vulnerability. This vulnerability stemmed from calls to functions like Path.glob and Path.rglob, which followed symbolic links. As a...

PT-2026-41350

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting XSS vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post...

Vvveb 跨站脚本漏洞

Vvveb is a powerful and easy-to-use CMS developed by Givan’s developers, used for building websites, blogs, or e-commerce stores. Versions of Vvveb prior to 1.0.8.3 had a cross-site scripting vulnerability, which stemmed from allowing permission upgrades through the post editor...

PT-2026-41348

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Description An issue exists where the system fails to enforce the PostEditTimeLimit on non-message post fields. This allows an authenticated user to modify...

CVE-2026-8597

creationtimestamp| type| source ---|---|--- 2026-05-14 22:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlttjwjlqv2p...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the GET /api/tasks and POST /api/tasks/stop/taskid endpoints, which lack proper ownership checks. An attacker can enumerate and terminate background tasks belonging to other users by...

CVE-2026-24662

creationtimestamp| type| source ---|---|--- 2026-05-14 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN69128376 2026-05-15 07:25:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlusjavsrk2i...

CVE-2026-45147 SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any...

CVE-2026-8584

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:56:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltsqdeozq2e 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8583

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:46:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlts673t6w2o...

CVE-2026-8575

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:29:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltr7hslhl2i 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8578

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:37:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrmr5sjx2q 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8577

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrfp5un52t 2026-05-17 18:00:00+00:00| seen|...