MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-11892 Malicious code in @servicetitan/marketing-form (npm)

npm/@servicetitan/marketing-form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

firefox: thunderbird: Information disclosure in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Graphics: ImageLib component...

CVE-2026-14824

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

EUVD-2026-52585

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-18686

creationtimestamp| type| source ---|---|--- 2026-08-04 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117034649197021910 2026-08-04 01:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms7ugrbllc2x 2026-08-04 02:01:18+00:00| seen|...

SUSE CVE-2026-16243

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-18641 Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

CVE-2026-18641

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

EUVD-2026-52416

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

EUVD-2025-210610

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69085

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or...

CVE-2026-69091

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-16534 Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

EUVD-2026-52163

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...