PT-2026-65683

Name of the Vulnerable Software and Affected Versions Cosmos-Server affected versions not specified Description An authentication bypass exists in the tokenMiddleware function within src/proxy/routerGen.go. The issue occurs when the Constellation-tunnel bypass branch is triggered, causing the...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

Malicious code in wrld-dev (npm)

Source: amazon-inspector 58965a325ad88c872b7c01668e4c08ca337b5fa022c15e626e23697d23fb594c The package exposes a public authentication API auth.user.login, auth.user.register, auth.user.get, auth.user.delete, plus an auth.system RPC surface wired to a Supabase client constructed from AUTHURL/AUTHK...

Malicious code in koishi-plugin-fusheng-car (npm)

Source: amazon-inspector 35bbb2f7cdae32f1a5012363b81298fd339c96b83718db535d77c0bdc0f936ec lib/index.js contains a hardcoded base64-encoded QQ user ID 'Mjc1OTcyMDE2MQ==' decoding to '2759720161' checked inside the plugin's permission gate. When that ID matches the calling user, the function return...

Malicious code in tango-app-api-trax (npm)

Source: amazon-inspector e7d8f3ef8e6fa016bfc17617ebcedce012c6cce870d89564965a476c3ec8da1c The tarball contains live, importable credentials for systems other than the installer's own. src/controllers/internalTrax.controller.js hardcodes Lenskart POS authentication username tango.eye, password...

Malicious code in panrouter-admin (npm)

Source: amazon-inspector 390c706978c9207807a0aeb4b1e3dfc500847828c23f5ffb06a14171ca8e51e6 panrouter-admin ships relayclient.cjs, which connects to a hardcoded WebSocket endpoint at wss://jiuling.xyz/ws, registers the host with an identity of the form admin--, and on each inbound message containin...

Malicious code in @k18n/creatormarketplace-admin-language (npm)

Source: amazon-inspector 6213acbcf6c562c8a7690e6018490d502d8df9377a2ed85c5bca9d828ed261c8 Package claims the @k18n npm scope used internally by Kuaishou and publishes at version 99.0.0 — the canonical high-version dependency-confusion shape that causes internal builds resolving @k18n from public...

Malicious code in fiat-token-admin (npm)

--- Credit: OpenSSF source...

Malicious code in multer-orm (npm)

Source: amazon-inspector 7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161 multer-orm is a typosquat of the widely used multer middleware. Its README is copied from multer, but the package adds a load-time dropper in lib/feature.js that fires as soon as any consumer runs...

CVE-2026-66015

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

Resources Downloaded over Insecure Protocol

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol through the configuration API. An attacker can execute arbitrary PHP code by uploading a malicious ZIP file ...

CVE-2026-65616

The provided documents describe CVE-2026-65616 as an incorrect authorization validation in the refresh token signature that allows non-admin users to obtain a signed JFrog administrator token. This indicates a privilege escalation risk tied to the token signing/validation flow in the JFrog produc...

CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

EUVD-2026-49576

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-66015

CVE-2026-66015 /JFrog Platform: An authenticated privilege-escalation via an authorization flaw under admin-provisioned accounts could grant temporary platform administrator access. Documented as an authenticated threat with HIGH impact (confidentiality, integrity, availability). No specific expl...

EUVD-2026-49575

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-66015

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-66015 JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...