11 matches found
CVE-2026-19019: Incomplete Cleanup
A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...
CVE-2026-57862: Server-Side Request Forgery (SSRF)
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link...
@activepieces/piece-actualbudget (>=0.1.5, <=0.1.9), @actual-app/api (>=26.4.0-nightly.20260317, <=26.5.2) +5 more potentially affected by CVE-2026-50179 via @actual-app/core (>=26.4.0, <=26.5.2)
@actual-app/core NPM version =26.4.0, =0.1.5, =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =26.5.1, =26.5.2 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPCORE-17818137...
CSV Injection
Overview Affected versions of this package are vulnerable to CSV Injection via the escapeCsv function, which fails to neutralize formula-triggering prefixes in user-controlled fields when exporting data to CSV format. An attacker can cause arbitrary formula execution or data exfiltration by...
@activepieces/piece-actualbudget (>=0.1.5, <=0.1.9), @actual-app/api (>=26.4.0-nightly.20260317, <=26.5.2) +5 more potentially affected by CVE-2026-46672 via @actual-app/core (>=26.4.0, <=26.5.2)
@actual-app/core NPM version =26.4.0, =0.1.5, =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =26.5.1, =26.5.2 Source cves: CVE-2026-46672 Source advisory: SNYK:JS-ACTUALAPPCORE-17818141...
@actual-app/api (>=26.4.0-nightly.20260317, <=26.4.0), @actual-app/cli (>=26.4.0-nightly.20260319, <=26.4.0) +1 more potentially affected by CVE-2026-43872 via @actual-app/core (26.4.0-nightly.20260405)
@actual-app/core NPM version 26.4.0-nightly.20260405 is affected by a known vulnerability. The following packages have a transitive dependency on @actual-app/core and may be impacted: - @actual-app/api =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =0.1.7 Source cves: CVE-2026-43872...
MAL-2025-14091 Malicious code in adform-react-app-core (npm)
The package adform-react-app-core was found to contain malicious code...
Malicious code in adform-react-app-core (npm)
The package adform-react-app-core was found to contain malicious code...
MAL-2025-7134 Malicious code in @conversation-app/core-api (npm)
The package @conversation-app/core-api was found to contain malicious code...
MAL-2022-1635 Malicious code in bob-app-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f470c5440c88f4b1dd83ee5c79cf167f5ccd654921909341136f99ec78f75569 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
