PYSEC-2026-1289 DB-GPT vulnerable to Cross-Site Request Forgery

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...

MAL-2026-7421 Malicious code in sitefinitywebapp (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in picnic-work-app-terms-of-use-de (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in picnic-work-app-terms-of-use-fr (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in picnic-work-app-terms-of-use-nl (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7347 Malicious code in picnic-work-app-terms-of-use-nl (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7345 Malicious code in picnic-work-app-terms-of-use-de (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7346 Malicious code in picnic-work-app-terms-of-use-fr (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in manage-subscription-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7317 Malicious code in manage-subscription-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in liportal-web-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7313 Malicious code in liportal-web-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in bitu-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7219 Malicious code in bitu-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7078 Malicious code in @jesusvizcaino2021/app-push-base (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @jesusvizcaino2021/app-push-base (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7036 Malicious code in @app-tray-ui/stencil-component (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @app-tray-ui/stencil-component (npm)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1931 social-auth-app-django affected by Improper Handling of Case Sensitivity

Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix...

CVE-2026-34170

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...