CVE-2026-57999

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

CVE-2026-57999 luci-app-tailscale-community - Command Injection via tailscale.do_login RPC

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.dologin RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserverauthkey parameters are improperly quoted...

Malicious code in app-hotmart-blog-headless (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d84025bf61426d455a22babbef859c4d8e9cd9d9312bd6c93dfcdb8ad5264db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-13437

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

CVE-2026-13437

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

EUVD-2026-40127

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API...

CVE-2026-13437

Devolutions PowerShell Universal version 2026.2.0 is vulnerable to an information disclosure issue in the AI Agent job API . An authenticated user with AI Agent read access can obtain reusable, potentially higher-privileged authentication tokens because App Tokens are serialized in plaintext with...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Out-of-bounds Write due to OpenSSL (CVE-2025-15467)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS Database node users are vulnerable to Out-of-bounds Write due to OpenSSL. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a HTTP library...

CVE-2026-55844 Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to ...

CVE-2026-55844 Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to ...

CVE-2026-55844

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to ...

CVE-2026-55844

The Home Assistant iOS companion app prior to 2025.5.0 ignores the SSID allowlist for internal networks. It uses SSID to decide when to use the internal URL, but if no other URL is available it falls back to the internal URL, which can expose the user’s token on unsecure networks. Affected compon...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-44431, CVE-2026-44432)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-39373 DESCRIPTION: JWCrypto implements JWK, JWS...

CVE-2026-13601

creationtimestamp| type| source ---|---|--- 2026-06-29 12:00:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116833283825806725 2026-06-29 12:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpggufewex2l 2026-06-29 12:07:59+00:00| seen|...

236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers

New findings unearthed by Infoblox show that more than 236,000 websites are using investment scam templates built using a legitimate Chinese open-source, cross-platform application development framework called DCloud Uni-App. The templates power bogus cryptocurrency exchanges, multi-language...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-44727 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: OSV:PYSEC-2026-412...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: SNYK:PYTHON-MESOP-17751643...