CVE-2026-104079

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

EUVD-2026-95769

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

CVE-2026-104079: Missing Authorization

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

PT-2026-105202

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

AZL-105311 CVE-2026-67420 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

CVE-2026-67420

The rabbitmq-server messaging and streaming broker is vulnerable to unauthorized user impersonation due to a flaw in how it handles OAuth credential refreshes . When an existing AMQP connection refreshes a token—transitioning from one that grants impersonation privileges to one that does not—the ...

CVE-2026-67420: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

PT-2026-84665

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

Malicious code in soundsource (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3285c5fec24c01c9c463e85c199934f5a08da7e94277583430a6e3feb274add The package's source distribution contains Token.txt at the tarball root holding a live PyPI API token prefix pypi-AgEIcHlwaS5vcmc.... Anyone who...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

UBUNTU-CVE-2026-33249

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...

Malicious code in lookingan-jaja94 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a10b2a6763358bdc1a717233c4946b60636391f46d85fe079c724b038ec880e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45faebf774d4bc77174806ed291f085e894027e5145addc89728ddac5c45f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-yakuna21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f90e343136c8c6b63d37a6d090d227546a91993c6482f9c522bcccf47ffbad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in technical-albiko-tin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 608cc5a9f05227bfff30cbd34afd9d80737d1a499c286aa882615ee8ac0d0546 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uinsu-lisa-amaaba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1bf07d4add7903934483d4a865a7e4925b03388d4dece67d85d7a6cb75e2e2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inufgi-gotumafa-anuaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6beac3d4076c944f1b372ed18a4188313cc2f96c04f6fe693ba3f202a284f757 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153593 Malicious code in avomainah-fridaatqft-fafugofada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcde065a342e2367047931c74199831f3ddc5924f9cbedd96ef80f7e168d8805 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159619 Malicious code in manda-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1af83be92a4d78539a7b8b449ac1e8611de2926a3f0bc712b25a06a749ca5054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164739 Malicious code in rino-poke89 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac52e925efc3417f90dce7f480a75cd1136bf682f6042813904c84ffdf810f0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...