MAL-2026-6998 Malicious code in higherlogic-ocfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2 Package [email protected] is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published index.js is an empty...

Malicious code in babel-eslint-parser-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a6f04cbf0697b6ae409fb9e5ad0e25812dac6a2f43bd95722f1903ee2f71f7 Package name babel-eslint-parser-legacy is a one-suffix confusion against the legitimate babel-eslint-parser. The package's own main is an empty stub...

Malicious code in ag-charts-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c50b5a47dde18daf83760926662df3b9890de074cc00938de04892ac79a4d9 [email protected] is a hollow package empty index.js, no scripts, no documented functionality whose sole effect on installers is resolving its...

MAL-2026-6989 Malicious code in ag-charts-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c50b5a47dde18daf83760926662df3b9890de074cc00938de04892ac79a4d9 [email protected] is a hollow package empty index.js, no scripts, no documented functionality whose sole effect on installers is resolving its...

Malicious code in visa-cli-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0e8f566e285de1eec2c3cae07b0faaa8828080a4e1fed7e76e1fe43dfa571ec Package presents as an internal-looking corporate tooling name 'visa-cli-tools' published at an inflated version 99.9.1 — the canonical...

CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

PT-2026-56609

Name of the Vulnerable Software and Affected Versions Appium versions prior to 1.1.6 Description The Appium storage plugin contains a flaw where the handler for the 'POST /storage/delete' endpoint passes the user-supplied name variable directly into path.joinstorageRoot, name and the fs.rimraf...

CVE-2026-58192: Improper Limitation of a Pathname to a Restricted Directory

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

📄 Vtiger CRM 8.3.0 Shell Upload

This is a focused authenticated remote code execution proof of concept exploit for Vtiger CRM version 8.3.0. It logs into Vtiger, uploads a .phar PHP webshell through the Documents module, uses /storage/ directory listing to discover the randomized uploaded filename, then executes commands throug...

Linux USB Device Driver Heap Buffer Overflow DoS

The vulnerability of the uasqueuecommandlck function in the drivers/usb/storage/uas.c module of the Linux device driver framework is related to the pointer that becomes invalid after a certain period of time. Exploiting this vulnerability could allow an attacker to cause a service failure...

KACO Blueplanet GridSave SQL Injection Privilege Escalation

The vulnerability of the dual-way inverter series for KACO Blueplanet GridSave energy storage systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow attackers to enhance their privileges within the local network...

Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls

Overview Adalo’s no‑code application platform exposes complete user records through its database API for all applications built on both V1 and V2. Due to a platform-level flaw, authenticated users can retrieve full user data belonging to any Adalo application, regardless of configuration. This...

CVE-2026-55418

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

CVE-2026-55418

Summary: CVE-2026-55418 affects FastGPT prior to v4.15.0-beta5, where two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request. The key’s association with the caller’s team is not validated, allowing cross-team file d...

CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

Operation on a Resource after Expiration or Release

Overview @better-auth/scim is a SCIM plugin for Better Auth Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the deleteUser method when secondaryStorage is configured and session.storeSessionInDatabase is unset or set to false. An attacker...

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

Am I affected? Users are affected if all of the following are true: - They configure secondaryStorage on betterAuth... Redis, KV, or any external session cache. - session.storeSessionInDatabase is left unset or set to false the default. - Their application's deployment uses one or more of: - The...

Operation on a Resource after Expiration or Release

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the deleteUser method when secondaryStorage is configured and session.storeSessionInDatabase is unset ...