EUVD-2026-50199

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

CVE-2026-63229

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-63231

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

EUVD-2026-50126

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

EUVD-2026-50125

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-63230

Koollab LMS is affected by CVE-2026-63230, a pre-authentication SQL injection on the SCORM report endpoint. The vulnerability allows an unauthenticated attacker to read sensitive data, including personally identifiable information, credentials, and valid JWT tokens that could enable account takeo...

CVE-2026-63229

Koollab LMS is affected by CVE-2026-63229, a pre-authentication blind SQL injection in the SSO OAuth endpoint. An unauthenticated attacker can use a time-based SQL oracle to read sensitive data from the database, including personally identifiable information, credentials, and valid JWT tokens, po...

PT-2026-65701

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-15064

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

CVE-2026-15064 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

EUVD-2026-50024

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-14869

The CVE-2026-14869 entry documents a vulnerability in terraform-mcp-server (pre-1.1.0) where a flaw in the streamable-HTTP transport allows an unauthenticated remote attacker to trigger server-side requests that can redirect the Terraform API calls and the server-side authorization token to an at...

CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

MAL-2026-11156 Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264 The package extracts the AES-256-GCM master key for a separate product lark-cli from the macOS Keychain via security find-generic-password -s lark-cl...

Malicious code in xerohub-discord-voice-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86630f2d32ad3a1a8ae419e538be3c6b46ce5f64ea5e871e1ccdf34c402d0032 XerohubVoice.js exports startVoiceJoiner, advertised as a Discord voice-channel joiner, which POSTs the caller-supplied Discord USERTOKEN together wi...

MAL-2026-11154 Malicious code in xerohub-discord-voice-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86630f2d32ad3a1a8ae419e538be3c6b46ce5f64ea5e871e1ccdf34c402d0032 XerohubVoice.js exports startVoiceJoiner, advertised as a Discord voice-channel joiner, which POSTs the caller-supplied Discord USERTOKEN together wi...