CVE-2026-97061

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

EUVD-2026-85886

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061

Versions of Black Candy up to and including 3.2.1 are vulnerable to an information disclosure flaw. The application fails to scope playlist search queries to the currently authenticated session user. Consequently, any authenticated user can query the SearchController or Search::PlaylistsControlle...

PT-2026-97803

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

CVE-2026-97061: Missing Authorization

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...

EUVD-2026-43366

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through = 3.4.8...

CVE-2026-54826

Subscriber Insecure Direct Object References IDOR in SupportCandy = 3.4.6 versions...

Malicious code in elf-stats-holly-candy-802 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68dd8a728159d7ab35d9d3b969d2c7726a655feb9af8b5ed28cf080dbea12fc5 The package elf-stats-holly-candy-802 was found to contain malicious code...

EUVD-2025-202834

Malicious code in elf-stats-candystriped-cookiejar-799 npm...

EUVD-2025-202832

Malicious code in elf-stats-candystriped-star-592 npm...

Malicious code in elf-stats-nutmeg-candy-869 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222442d6a479dc874e15bf8892e986faf27bedc6a596cc2303159aa559ea136b The package elf-stats-nutmeg-candy-869 was found to contain malicious code...

EUVD-2025-202803

Malicious code in elf-stats-holly-candy-802 npm...

MAL-2025-192520 Malicious code in elf-stats-nutmeg-candy-869 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222442d6a479dc874e15bf8892e986faf27bedc6a596cc2303159aa559ea136b The package elf-stats-nutmeg-candy-869 was found to contain malicious code...

EUVD-2025-202789

Malicious code in elf-stats-nutmeg-candy-869 npm...

EUVD-2025-201113

Malicious code in elf-stats-sparkly-candy-805 npm...

Malicious code in elf-stats-sparkly-candy-805 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604bccab8df7d0898478ee7f58c010dbc4d632595944bbddf5c782e15e62a6c7 The package elf-stats-sparkly-candy-805 was found to contain malicious code...

MAL-2025-192283 Malicious code in elf-stats-sparkly-candy-805 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604bccab8df7d0898478ee7f58c010dbc4d632595944bbddf5c782e15e62a6c7 The package elf-stats-sparkly-candy-805 was found to contain malicious code...