58 matches found
DIRAC: Unauthorized users can read proxy contents during generation
ImpactDuring the proxy generation process e.g., when using dirac-proxy-init it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy.This vulnerability only exists for a sho...
EUVD-2026-30146
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this...
CVE-2026-33381 Users can generate Service Account tokens after permissions removal
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this...
Supreme Court to decide whether geofence warrants are constitutional
Google has weighed in on a court case that will decide the future of a powerful but contentious tool for law enforcement. The company submitted an opinion to the US Supreme Court arguing that geofence warrants are unconstitutional. A geofence warrant is a form of "reverse warrant" that turns a...
EUVD-2026-4467
Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the disk...
EUVD-2026-3833
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through = 4.4.9...
CVE-2025-65592
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages...
CVE-2025-65670
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio version 0.1.13 allows students to access sensitive admin and teacher endpoints. By manipulating course IDs in the URL, an attacker can bypass authorization checks and gain momentary access to privileged information, including...
EUVD-2025-100980
Malicious code in briefcoralz3n npm...
EUVD-2025-100978
Malicious code in brieffleaz3n npm...
Malicious code in brief_zebra_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b827a1614c6d692393488baacd700cf3c4ae7ed466c2bba7e33c3e2732380a1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-106340
Malicious code in briefzebraz3n npm...
EUVD-2025-92967
Malicious code in briefllamaz3n npm...
MAL-2025-100100 Malicious code in brief_opossum_0xrequest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a751f98e1c53e34e4c6ffd21f94c3dce3379167a9c6ad92ccca2011d44e1579 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in brief_unicorn_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8e12e0e35f9187e09958288ef8682418bd0c29e20be5eb784706d46758c1ef4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in brief_mosquito_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cab4846fc4bd32f8f9f855b8aca5db272bb09795e38a810cfb6006dec53946 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-65121
Malicious code in briefsilverfishz3n npm...
Malicious code in brief_wolverine_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff1686621b836a8d2ae8b1f8f2fe7e154b56514af658d2b163313264b8e840b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...