Malicious Package

Overview devplatform-spa-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

PT-2026-81027

Name of the Vulnerable Software and Affected Versions Mistune versions 3.3.0 through 3.3.2 Description This issue allows a Denial of Service DoS through deeply nested tokens. When rendering HTML, consecutive asterisk characters can create deeply nested emphasis tokens. The recursive rendering...

PT-2026-81053

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.2 CakePHP Authentication versions 3.0.0 through 3.3.6 CakePHP Authentication versions 4.0.0 through 4.2.0 Description An authentication bypass and potential CPU or memory exhaustion can occur when...

CVE-2026-76098: Uncontrolled Recursion

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

CVE-2026-77337: Authentication Bypass by Spoofing

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses...

SUSE CVE-2026-73086

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoidsize function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corru...

CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 is affected by an authorization bypass vulnerability. The root cause is that the getToken() function creates tokens without binding them to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors . An attac...

peirates v1.29

Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...

Krawl v2.3.0

Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...

Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

CVE-2026-77029

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

CVE-2026-77029 Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

CVE-2026-77029

Zoo , a Joomla extension by yootheme.com , is affected by a missing CSRF token vulnerability on front-end state changes in versions prior to 4.1.66 . The CVSS 4.0 base score is 4.6 (MEDIUM) , with high privileges and active user interaction required, resulting in low integrity impact . No exploit...

EUVD-2026-63934

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

PT-2026-79383

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...

CVE-2026-64964

ATutor (open-source learning management system) is vulnerable to predictable email confirmation token generation in its account confirmation functionality. The root cause is the use of insufficiently random values tied to user registration, allowing an attacker who can predict these values to gue...

CVE-2026-64964: Generation of Predictable Numbers or Identifiers

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

CVE-2026-76389 Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76366 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...