Malicious code in api-anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19164d6b4b781d022a4bc75ae45fae6d20737ddc0b711057e89990d39efc8df5 The npm package api-anthropic impersonates Anthropic branding both the package name and the destination domain api-anthropic.help and reconfigures th...

MAL-2026-18055 Malicious code in api-anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19164d6b4b781d022a4bc75ae45fae6d20737ddc0b711057e89990d39efc8df5 The npm package api-anthropic impersonates Anthropic branding both the package name and the destination domain api-anthropic.help and reconfigures th...

Malware in api-anthropic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

grafana: Grafana: Unauthorized cross-organization user management via the SCIM API

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management SCIM API. This allows an authorized...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...

CVE-2026-105815

The TP-Link Tapo C210 (V3.60) is vulnerable to an Improper Authentication flaw (CWE-287) where unauthenticated DS JSON API requests expose shared credential material and cryptographic metadata. An unauthenticated attacker on an adjacent network can leverage this exposed material as an administrat...

CVE-2026-105814

The TP-Link Tapo C210 (V3.60) contains an authentication bypass vulnerability within the DS JSON API . The root cause is an order-dependent flaw where a crafted JSON request combining a protected operation with public onboarding-related fields causes inconsistent module-level authorization checks...

CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6714 Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api

Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6722 Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api

Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6753 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-6752 Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6721 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

GO-2026-6748 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6749 Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...