CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-55863

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post method in motioneye/handlers/action.py lacks the BaseHandler.auth decorator, allowing an unauthenticated remote...

EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966

In XWiki Platform (a generic wiki platform), the Live Data edit REST API fails to perform normal document-saving authorization checks when a user modifies page rights. Any user with edit permission can escalate to script right, enabling execution of potentially dangerous Velocity scripts or deliv...

CVE-2026-53966

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

Malicious code in ultra-ws (npm)

Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a document creates a sandboxed iframe without allow-scripts, and then appends an element to the iframe’s document that has a JavaScript event handler—the event handler will still be executed despite the iframe being in a sandbox. This vulnerability affects Firefox versions earlier than 97,...

Astra Linux – Vulnerability in Zabbix

JavaScript preprocessing, webhooks, and global scripts can lead to uncontrolled utilization of CPU, memory, and disk I/O resources. The ability to preprocess/webhook/configure and test global scripts is only available to Administrative roles Admin and Superadmin. Administrative privileges should...

Malicious code in joko-klanting70-riris (npm)

Source: amazon-inspector 6e98d0c77d583b569536c9ed5708885ae720ffca47de2046b862532060be8fc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting57-breki (npm)

Source: amazon-inspector 0c428c01fadb33d32b8b138d77fb04ac1c17b0f9dafd1a392bbc904447537f86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketoprak70-breki (npm)

Source: amazon-inspector d1f69c051add2ae3619e6903f0261bf62c253b5095f0c95abee5c9c54f25ac83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting72-miaww (npm)

Source: amazon-inspector 03dba51cbf38ac8e5cbde1fbecfb2182204285b77564de32f21203dc936f9b5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting28-sluey (npm)

Source: amazon-inspector 3186fb531c97a5c8f8d341128ac55a50ac9f5e14ed8ec769e14c2cf80e21f0c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting55-breki (npm)

Source: amazon-inspector fcd00e3a02dd3249203d511087599b3d08f8fa63ce46249bfe3d6ab12c008a12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketan37-apidev (npm)

Source: amazon-inspector 128bd546b85f3471f53426b2ac30ad0cc90cc2aa82b0b1226c20a032bb9d8c89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keripik42-sukiwir (npm)

Source: amazon-inspector 686965d4ac31e0459ce1da77046360254bb86ff96c7cc4bf0b3c8be413d55ffd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketoprak89-breki (npm)

Source: amazon-inspector a3ea99c4b2867cbdbfdc63b2ce6717cd21452eeba12d5819ba2cd25b01dbab4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketoprak52-sukiwir (npm)

Source: amazon-inspector 1b4bfb8a1fb52498204a20a00105747d60d700b54f0984590ef0e52bcc1e6fd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-keripik2-ruro (npm)

Source: amazon-inspector e6b822210d09e1ade30e523d6352e97e906fa7745b8bed435a4811e70fa455f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...