CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

In this article 1. Activity overview 2. How ClickFix works 3. Campaign overview 4. ClickFix moved from open pages to fingerprinting gates 5. The fingerprinting gate 6. Mitigation and protection guidance 7. Indicators of compromise IOC 8. References 9. Learn more Microsoft Threat Intelligence...

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

In this article 1. Activity overview 2. How ClickFix works 3. Campaign overview 4. ClickFix moved from open pages to fingerprinting gates 5. The fingerprinting gate 6. Mitigation and protection guidance 7. Indicators of compromise IOC 8. References 9. Learn more Microsoft Threat Intelligence...

Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

MAL-2026-13260 Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-12897 Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

MAL-2026-12964 Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating o...

cvelistV5 cve_2026-08-05_1300Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

EUVD-2026-53389

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923

CVE-2026-39923 affects Flarum prior to 1.8.16. A password reset token expiry bypass allows unauthenticated attackers to reuse expired tokens by POSTing to the reset endpoint; SavePasswordController::handle() calls PasswordToken::findOrFail() without expiry validation, bypassing the 24-hour token ...

MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

MAL-2026-12653 Malicious code in cobrowsing-decorators (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...