7418 matches found
CVE-2026-21631
CVE-2026-21631 affects Joomla! Core, specifically the multilingual component com_associations comparison view. Root cause: lack of output escaping enabling a cross-site scripting (XSS) vector. Connected advisories confirm the vulnerability exposure in the core UI component and indicate a remediat...
GO-2026-4829 NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server...
CVE-2026-32968
CVE-2026-32968 describes an unauthenticated RCE in the MB CONNECT LINE MBCONNECT24 family (mymbCONNECT24 and mbCONNECT24) up to version 2.5.0. The vulnerability arises from improper neutralisation of special elements used in an OS command, allowing a remote attacker to execute code and potentiall...
PT-2026-27108
Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383...
MAL-2026-1797 Malicious code in nextiva-dot-com (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b526416f0bec682e1493700f926a23b44ef0517c358700e8a9b0025028363f0c The package nextiva-dot-com was found to contain malicious code...
Malicious code in nextiva-dot-com (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b526416f0bec682e1493700f926a23b44ef0517c358700e8a9b0025028363f0c The package nextiva-dot-com was found to contain malicious code...
MAL-2026-1632 Malicious code in @nxt-costco-com/forge-design-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e4556dfaa2a30079bf31edd7c9a378deacc22b763f547a4b825d57945debef The package @nxt-costco-com/forge-design-tokens was found to contain malicious code...
Transparent COM instrumentation for malware analysis
COM automation is a core Windows technology that allows code to access external functionality through well-defined interfaces. It is similar to traditionally loading a DLL, but is class-based rather than function-based. Many advanced Windows capabilities are exposed through COM, such as Windows...
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
Summary A vulnerability exists in the Community Tier of Harden-Runner that allows bypassing the egress-policy: block network restriction using DNS queries over TCP. Harden-Runner enforces egress policies on GitHub runners by filtering outbound connections at the network layer. When egress-policy:...
MAL-2026-3125 Malicious code in transform-regexp-constructors (npm)
The package 'transform-regexp-constructors' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
[20260303] - Core - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component...
CVE-2026-3670
A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Performing a manipulation results in improper authorization. The attack requires a local approach. The exploit is now public and may be used. The vendor was...
CVE-2026-3670 Freedom Factory dGEN1 com.dgen.alarm improper authorization
A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Performing a manipulation results in improper authorization. The attack requires a local approach. The exploit is now public and may be used. The vendor was...
CVE-2026-3669 Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization
A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Such manipulation leads to improper authorization. The attack needs to be performed locally. The exploit has been disclosed publicly and may ...
CVE-2026-3669 Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization
A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Such manipulation leads to improper authorization. The attack needs to be performed locally. The exploit has been disclosed publicly and may ...
[20260302] - Core - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint...
Malicious Package
Overview @bookings.microsoft.com/s is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
IBM: SQL Injection vulnerability found on ibm.com endpoint
A SQL injection vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated...
CleverTap Web SDK 安全漏洞
The CleverTap Web SDK is an open-source developer toolkit developed by CleverTap. Versions of the CleverTap Web SDK prior to 1.15.2 contain security vulnerabilities. These vulnerabilities stem from the source validation in the Visual Builder module, where the includes method is used to check...
