11 matches found
Malicious Package
Overview bx-ui-view is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
Malicious code in bx-ui-view (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...
MAL-2026-16064 Malicious code in bx-ui-view (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...
apache-airflow DAG source authorization bypass exposes co-located DAG source
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...
CVE-2026-12799
A flaw was found in BerriAI litellm. A remote attacker could exploit an improper authorization vulnerability in the uiviewusers function to gain access to sensitive information. This issue is related to an incomplete fix for a previous vulnerability. Mitigation To reduce exposure, restrict networ...
CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
CVE-2026-12799
The CVE-2026-12799 entry concerns BerriAI litellm up to version 1.82.2. The vulnerability affects the function ui_view_users in litellm/proxy/management_endpoints/internal_user_endpoints.py (component: Incomplete Fix CVE-2025-0628) and enables improper authorization. The issue can be exploited re...
com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=14.90.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=14.62.0) +13 more potentially affected by CVE-2026-41240 via org.webjars.npm:dompurify (>=3.1.7, <=3.3.0)
org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.55.1 Source cves: CVE-2026-41240 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16078388...
com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=14.90.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=14.62.0) +13 more potentially affected by CVE-2026-0540 via org.webjars.npm:dompurify (>=3.1.7, <=3.3.0)
org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.55.1 Source cves: CVE-2026-0540 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15371377...
Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
Impact What kind of vulnerability is it? Who is impacted? A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ to list the...
