10972 matches found
CVE-2026-13450
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This...
CVE-2026-13450: Authorization Bypass Through User-Controlled Key
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This...
PT-2026-56718
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This...
activity-browser (>=3.0.0b966, <=3.0.0b202610031934), aibench (>=0.0.2, <=0.0.5) +98 more potentially affected by CVE-2026-55206 via py7zr (>=0.4.4, <=1.1.0)
py7zr PYPI version =0.4.4, =3.0.0b966, =0.0.2, =0.0.0, =1.0.12, =0.9.0, =0.7.4, =3.5.4, =0.6.42, =0.2.1, =1.0.0, =2.0.1, =0.5.4, =0.10.0 - cafex 1.0.0 - cafex-api 1.0.0 - cafex-core 1.0.0 and more Source cves: CVE-2026-55206 Source advisory: MEND:CVE-2026-55206...
activity-browser (>=3.0.0b966, <=3.0.0b202610031934), aibench (>=0.0.2, <=0.0.5) +98 more potentially affected by CVE-2026-55195 via py7zr (>=0.4.4, <=1.1.0)
py7zr PYPI version =0.4.4, =3.0.0b966, =0.0.2, =0.0.0, =1.0.12, =0.9.0, =0.7.4, =3.5.4, =0.6.42, =0.2.1, =1.0.0, =2.0.1, =0.5.4, =0.10.0 - cafex 1.0.0 - cafex-api 1.0.0 - cafex-core 1.0.0 and more Source cves: CVE-2026-55195 Source advisory: MEND:CVE-2026-55195...
Malicious code in events-alias (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 164642716a755117674746c1c2534b0ac47d56bed2348e7a800c3d37a98074e9 The package's preinstall hook "node index.js" runs automatically on npm install and executes an exfiltration payload. index.js requires childprocess,...
Malicious code in domains-billing-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4860726efc056e319a24e46ac4e179809cc294267679a9b8122c5205b49369f1 [email protected] executes node index.js from its postinstall lifecycle script. On install, index.js reads os.hostname and...
Malicious code in py-slugify (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 67a9d1e498fcf994bbfd8e10bde000990fe4579a88ba5b20848beabac1ae44cc During import, this malicious copy of a legitimate package downloads an encrypted data disguise as an image. It contains an archive with a next-stage script th...
CVE-2020-28734
creationtimestamp| type| source ---|---|--- 2026-07-07 20:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3hhejvq42k...
MAL-2026-6955 Malicious code in hello244b (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 641cbcb87d26ccab92d1273dd083f15fa88ba5dad915c148f6500789f4596e4a The OpenSSF Package Analysis project identified 'hello244b' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in hello244b (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 641cbcb87d26ccab92d1273dd083f15fa88ba5dad915c148f6500789f4596e4a The OpenSSF Package Analysis project identified 'hello244b' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in @athena-ui-components/user-activity (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7048 Malicious code in @athena-ui-components/user-activity (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-34167
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...
CVE-2026-34167
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...
CVE-2026-34167 Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...
EUVD-2026-41959
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...
CVE-2026-34167
Coolify (open-source self-hosted) has a vulnerability in the ActivityMonitor Livewire component prior to version 4.0.0-beta.471: a public $activityId property is not protected with Livewire’s #[Locked] attribute, allowing any authenticated user to enumerate activity records across all teams and r...
CVE-2026-34167 Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...
BIT-MASTODON-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...