CVE-2026-49994

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994: Missing Authentication for Critical Function

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

Exposure of Resource to Wrong Sphere

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere through the evalhandler process...

CVE-2026-87812: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

CVE-2026-87811: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling...

Origin Validation Error

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

PT-2026-45556

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0 Description A flaw allows a single SCTP connection to bind multiple xapp ids by sending multiple E42 SETUP REQUESTs. Upon disconnection, the system only cleans up resources for the first registered xapp id, leaving...

Juniper Junos OS Multiple Vulnerabilities (JSA82974)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA82974 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64...

EUVD-2017-5418

Malware in sbrugna...

EUVD-2021-17613

Malware in sbrugna...

EUVD-2020-30720

Malware in sbrugna...

EUVD-2020-30757

Malware in sbrugna...

EUVD-2021-31357

Malicious code in bioql PyPI...

EUVD-2023-54651

Malicious code in bioql PyPI...

EUVD-2023-32655

Malicious code in bioql PyPI...

NewStart CGSL MAIN 7.02 : tongsuo Vulnerability (NS-SA-2025-0197)

The remote NewStart CGSL host, running version MAIN 7.02, has tongsuo packages installed that are affected by a vulnerability: - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platfo...

CVE-2023-29051

User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users...

CVE-2021-30696

An attacker in a privileged network position may be able to misrepresent application state. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A logic issue was addressed with improved state management...