Malicious code in authtoken-paypal (npm)

The package authtoken-paypal was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-68901

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from...

CVE-2026-68901 WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from...

CVE-2026-68901 WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from...

CVE-2026-68901

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from...

EUVD-2026-62714

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

PT-2026-68150

Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description The AuthToken request-guard implementation in api/src/main.rs fails to validate the value of the Authorization HTTP header against a session, token store, or signature. It only...

CVE-2026-71277: Improper Authentication

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

Hardcoded .npmrc AuthToken Detection

Detects Hardcoded .npmrc AuthToken. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Hardcoded .""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hardcoded .npmrc AuthToken Detection', 'description': 'Detects...

Malicious code in @arbocollab/arbo-web-people (npm)

Source: amazon-inspector 3f007c3da95aa64e4c2ed5b51b736900ddc444499f2f678d749603fab516a0c3 The published tarball ships npmjs.npmrc containing a live npm-prefixed authToken for registry.npmjs.org scoped to @arbocollab. package.json declares "files": "" and .npmignore does not exclude npmjs.npmrc, s...

EUVD-2011-2333

Malware in sbrugna...

EUVD-2018-2948

Malware in sbrugna...

EUVD-2021-26844

Malware in sbrugna...

EUVD-2022-45066

Malicious code in bioql PyPI...

EUVD-2022-28957

Malicious code in bioql PyPI...

MAL-2025-15103 Malicious code in authtoken-paypal (npm)

The package authtoken-paypal was found to contain malicious code...

Malicious code in authtoken-paypal (npm)

The package authtoken-paypal was found to contain malicious code...

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

CVE-2022-24042

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application returns an AuthToken that does not expire at the defined auto...