EUVD-2026-52753

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-58071

The vulnerability CVE-2026-58071 affects the Veeam Service Provider Console. An unauthenticated attacker can access the proxied appliance API as Portal Administrator during a short window after an administrator session begins. This could expose sensitive API controls to an unauthenticated user wi...

Malicious code in @servicetitan/titan-chatbot-api (npm)

npm/@servicetitan/titan-chatbot-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11939 Malicious code in @servicetitan/titan-chatbot-api (npm)

npm/@servicetitan/titan-chatbot-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

EUVD-2026-52743

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

MAL-2026-11843 Malicious code in @servicetitan/cp-api (npm)

npm/@servicetitan/cp-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in @or-sdk/api-tokens (npm)

npm/@or-sdk/api-tokens is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

CVE-2026-67618

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

Missing Authorization

Overview flowise-ui is a Affected versions of this package are vulnerable to Missing Authorization in the /api/v1/files route, which lacks proper permission checks for file listing and deletion operations. An attacker can access and remove files belonging to other workspaces within the same...

Missing Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Missing Authorization in the /api/v1/files route, which lacks proper permission checks for file listing and deletion operations. An attacker can access and remove files belonging to other workspaces within...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CLSA-2026-1778460297 TuxCare security update for com.microsoft.ews-java-api:ews-java-api (1 CVE)

TuxCare rebuilt com.microsoft.ews-java-api:ews-java-api to address 1 CVE. Fixed in 2.0-tuxcare.1...

CVE-2026-67618 marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

CVE-2026-67618 marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

CVE-2026-67618

The vulnerability CVE-2026-67618 affects marimo before version 0.23.15. It stems from insufficient sanitization in sanitize_pyproject_dict, allowing a notebook author to inject a malicious base_url via PEP-723 inline script metadata. The attacker-controlled base_url is merged into session configu...

Authorization Bypass Through User-Controlled Key

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the refresh endpoint in the OAuth2 credential API. An attacker can access sensitive credential secrets and trigger server-side HTTP requests to arbitrary...

MAL-2026-11724 Malicious code in @or-sdk/sdk-api (npm)

npm/@or-sdk/sdk-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

Malicious code in @servicetitan/standalone-tm-api (npm)

npm/@servicetitan/standalone-tm-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/moneyout-api-client (npm)

npm/@servicetitan/moneyout-api-client is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...