CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key

Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...

CVE-2026-0622

Open5GS WebUI is affected by CVE-2026-0622: by default it uses hard-coded JWT signing keys (the string change-me) when JWT_SECRET_KEY is unset, allowing an unauthenticated network attacker to forge JWTs and gain access to protected WebUI endpoints (notably under /api/db/*). The issue arises from ...

Kimai has an Authenticated Server-Side Template Injection (SSTI)

Kimai 2.45.0 - Authenticated Server-Side Template Injection SSTI Vulnerability Summary | Field | Value | |-------|-------| | Title | Authenticated SSTI via Permissive Export Template Sandbox || Attack Vector | Network | | Attack Complexity | Low | | Privileges Required | High Admin with export...

GHSA-JG2J-2W24-54CG Kimai has an Authenticated Server-Side Template Injection (SSTI)

Kimai 2.45.0 - Authenticated Server-Side Template Injection SSTI Vulnerability Summary | Field | Value | |-------|-------| | Title | Authenticated SSTI via Permissive Export Template Sandbox || Attack Vector | Network | | Attack Complexity | Low | | Privileges Required | High Admin with export...

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...

security-antipatterns-javascript

Security Anti-Patterns for JavaScript AI coding agents don't...

MAL-2026-361 Malicious code in gu-global-ec-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af8b504bec83c372b24f21eb2b83e6a5ec1ceceef82ba4b57dc401e1ab44f9a4 The package gu-global-ec-uikit was found to contain malicious code. Source: ghsa-malware...

Malicious code in excel-to-json-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c7026badcf8f0b9dc17b6d25ace35a5659488148496f385d17d4d3d31b036c9 The package excel-to-json-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in telia-eventapi-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610f6e993efc4a5c573b9fb5533234a0b9d69c997461873bf02f863c643916e0 The package telia-eventapi-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70584b6893352163c2a0c5341a2e577feaec7949d8719725a62e0d87e5b1d542 The package chai-bin was found to contain malicious code. Source: ghsa-malware a1636ea6e8016a1000135fcda28819cd75c13f4a95933606b7e792737fe630f0 Any...

MAL-2026-356 Malicious code in react-server-dom-unbundled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a00ece23d0316d703248d00b48a8a29b2ed829ae8e1bce8f1bfd6a404820b21 The package react-server-dom-unbundled was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-server-dom-unbundled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a00ece23d0316d703248d00b48a8a29b2ed829ae8e1bce8f1bfd6a404820b21 The package react-server-dom-unbundled was found to contain malicious code. Source: ghsa-malware...

Qnap QTS and QuTS hero Out-of-bounds Read (CVE-2025-54165)

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero Out-of-bounds Read (CVE-2025-54166)

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS...

Node.js security vulnerabilities

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. There are security vulnerabilities in Node.js, stemming from defects in buffer allocation logic. These vulnerabilities may lead to uninitialized memory leaks, resulting in the disclosure o...

PT-2026-3742

Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...

Qnap QTS and QuTS hero Use of Externally-Controlled Format String (CVE-2025-53591)

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

Malicious code in tutor_table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d11a723f74a2369662e6322495f50a32bdb5dbb2d2022b1c44c55e2e3a8738d3 The package tutortable was found to contain malicious code. Source: ghsa-malware 3e6e46b475e720d998048f0eb1d07e6d3aef827537e27d7fc205902884be9aba Any...

Malicious code in internal-company-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8dfa7267565b0ac4a94eb2d7fda38475a0ff412b196f5bdc842e73f9671455 The package internal-company-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-345 Malicious code in private-payment-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c4346497d58e1d5eca5c47353d4491578827b6095eb0f62dc7ff4449c0758b The package private-payment-lib was found to contain malicious code. Source: ghsa-malware...