86530 matches found
MAL-2026-11525 Malicious code in nagix-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...
Malicious code in nagix-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...
EUVD-2026-39021
Ghost: File Upload Content-Type Spoofing...
NPM: Ghost: File Upload Content-Type Spoofing
NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...
GHSA-944X-PM95-3JPR Ghost: File Upload Content-Type Spoofing
Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the...
boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15830 via django (2.1.4)
django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15307 via django (2.1.4)
django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15830 via django (2.2.7)
django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15307 via django (2.2.7)
django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
CVE-2026-18788
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...
boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2026-15830 via django (2.1.4)
django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
fusionflow-upload (>=0.0.6, <=0.1.5) potentially affected by CVE-2026-15830 via django (2.2.7)
django PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - fusionflow-upload =0.0.6, =0.1.5 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...
CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...
CVE-2026-18788
Trippo ResponsiveFilemanager
CVE-2026-18788
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...
katello: missing repository authorization in content_uploads exposes cross-product content existence
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the editproducts permission to query content information for repositories outside the products they were authorized to...
katello: missing repository authorization in content_uploads exposes cross-product content existence
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the editproducts permission to query content information for repositories outside the products they were authorized to...
CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...