Malicious code in unreal-mladapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126bf3493d123333b47fba2ed68e30c085c8266dfb4d16923a81e9ee094f4780 The package name unreal-mladapter mimics Epic Games' internal UnrealMLAdapter plugin and is published at version 99999.0.0 — the canonical high-versi...

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

AZL-92103 CVE-2026-38968 affecting package ntopng 5.2.1-6

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

CVE-2026-54262

creationtimestamp| type| source ---|---|--- 2026-07-02 14:28:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaj35qfl27 2026-07-03 13:26:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnk6jp5n2c...

CVE-2026-54704

creationtimestamp| type| source ---|---|--- 2026-07-02 14:26:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoagu42pq2i 2026-07-03 09:28:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqa7twgj52w 2026-07-29 19:31:52+00:00| seen|...

CVE-2026-13251

creationtimestamp| type| source ---|---|--- 2026-07-02 14:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpo7rpkclv27 2026-07-02 22:22:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2yymfoc2o 2026-07-02 22:22:22+00:00| seen|...

EUVD-2026-41274

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprploadmorerevs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $POST'notinstring' and passed through sanitizetextfield — which strips HTML and...

CVE-2026-9188 Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the appointmentkey parameter due to the appointment editkey — the sole authorization token consumed by tryCance...

CVE-2026-11600

creationtimestamp| type| source ---|---|--- 2026-07-02 07:56:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnkmhbiqe2n 2026-07-02 20:09:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpotl54boy2w...

CVE-2026-49088

creationtimestamp| type| source ---|---|--- 2026-07-02 07:33:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnjcw7lzb2m 2026-07-02 13:50:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpo6flfadf2t...

CVE-2026-14080

creationtimestamp| type| source ---|---|--- 2026-07-02 06:22:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfeopjtz2b 2026-07-02 07:51:45+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:45:24+00:00| seen|...

CVE-2026-14077

creationtimestamp| type| source ---|---|--- 2026-07-02 01:45:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvviwwfd27 2026-07-02 07:51:38+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:45:13+00:00| seen|...

CVE-2026-5142

creationtimestamp| type| source ---|---|--- 2026-07-02 00:35:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmry7olzh2y 2026-07-02 01:57:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmwlmecux27 2026-07-02 08:10:19+00:00| seen|...

PT-2026-55271

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 25.3 through 29.0.2 Erlang/OTP versions 28.x prior to 28.5.0.3 Erlang/OTP versions 27.x prior to 27.3.4.14 ssl versions 10.9 through 11.7.2 ssl versions 11.6.x prior to 11.6.0.3 ssl versions 11.2.x prior to 11.2.12.10...

PT-2026-54949

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp load more revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $ POST'notinstring' and passed through sanitize text field — which strips HTML an...