139 matches found
CVE-2026-50601
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
CVE-2026-50601
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
EUVD-2026-60025
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
PT-2026-73192
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
Race condition grunt Dependency in Bitbucket Data Center
This High severity Race condition vulnerability was introduced in version 10.3.0 of Bitbucket Data Center. This Race condition vulnerability, with a CVSS Score of 7 and a CVSS Vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H allows an authenticated attacker to modify code sequences in which...
Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
A vulnerability in open-webui/open-webui versions = 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery CSRF. The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious...
AlmaLinux 9 : nginx:1.24 (ALSA-2026:6923)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:6923 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...
CVE-2026-1514: Incorrect Authorization
Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify front-end code to read all official documents...
CVE-2019-11617
doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification...
CVE-2025-12958
The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankologycodeblock' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level acces...
CVE-2025-51682
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly...
CVE-2025-51682
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly...
Malicious code in cosmology-geodynamo-blaze-perturbation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba766eb5f32777db3374986c46fd236e4668d7897069846749971a67037b8c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-183278 Malicious code in kisut-diug-danugamicffoa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d47cdd2474e71ab3f21729fab333fb2161e774dc9e3b27786de0fcad9175b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in riyanto-poke84 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2da32924d8eccffe5de6f6d26e5c9f9f746f0ba606ca9957f5dc95f0c42c538 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in dotenv-blitz-gatsby-publish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30494edd46176223c947540db528ceecf7879aa472f791139f7645ad492e282b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-134449 Malicious code in isolated_dinosaur_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1164fd97ffca01c0ad315eed47fcd56cbb7ae79337a30fdea4b958f27e90a8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-89682 Malicious code in putri-kupang55-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881a509638e009409da7ac1300631b76499b8c0304bf0976d5338f56f4520a0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...