Malicious code in @3stripes/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fea72a3f12c815ec03d587d20386eb4726c301d381fa23d720c25dc903bdcb4 The package @3stripes/config was found to contain malicious code...

MAL-2026-2704 Malicious code in @3stripes/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fea72a3f12c815ec03d587d20386eb4726c301d381fa23d720c25dc903bdcb4 The package @3stripes/config was found to contain malicious code...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the GymConfigUpdateView. An attacker can gain unauthorized control over installation-wide configuration and modify other users' records by submitting changes to the /config/gym-config/edit endpoint as a...

PT-2026-34731

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description The '/api/v1/public-chatbotConfig/:id' endpoint exposes sensitive data without requiring authentication. An attacker who possesses a chatflow UUID can retrieve internal configuration, HTTP...

PT-2026-33301

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.5 Description An improper access control issue exists in the GymConfigUpdateView component. The view declares a required permission config.change gymconfig but fails to enforce it at runtime because it inherits...

PT-2026-34843

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.17.2 Description A flaw in the ConfigMap context loader allows for cross-namespace privilege escalation. The configMap.namespace field lacks validation, enabling a namespace administrator to read ConfigMaps from any...

PT-2026-44910

Name of the Vulnerable Software and Affected Versions axios versions 0.x through 1.x Description A prototype pollution gadget in the lib/adapters/http.js component allows an attacker to escalate any Object.prototype pollution within an application's dependency tree into a full Man-in-the-Middle...

CVE-2026-40176

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method, which constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client without...

EUVD-2026-22987

Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentials...

EUVD-2026-22985

Slah CMS v1.5.0 and below was discovered to contain a remote code execution RCE vulnerability in the session function at config.php. This vulnerability is exploitable via a crafted input...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Authenticated Remote Code Executio...

CVE-2026-30778 Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue...

CVE-2026-30778

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue...

CVE-2026-30778

Apache SkyWalking versions 9.7.0 through 10.3.0 are vulnerable to a security flaw where the OAP /debugging/config/dump endpoint may leak sensitive configuration information related to MySQL or PostgreSQL . This exposure can potentially expose critical database credentials or settings. To remediat...

CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API

The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...

CVE-2026-3643

The Accessibly WordPress plugin (versions ≤ 3.0.3) is vulnerable to an unauthenticated Stored XSS via REST API endpoints /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config. These endpoints have permission_callback set to __return_true, so no auth checks occur. updateWidgetOptions()...

MAL-2026-2679 Malicious code in snitz-chief-cloud-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24a91d88d68aae1e6311a7d533b3efc0618206a56025c6a96c1f1024b3ccf9df The package snitz-chief-cloud-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in snitz-chief-cloud-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24a91d88d68aae1e6311a7d533b3efc0618206a56025c6a96c1f1024b3ccf9df The package snitz-chief-cloud-config was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview snitz-chief-cloud-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-30993

Slah CMS v1.5.0 and below was discovered to contain a remote code execution RCE vulnerability in the session function at config.php. This vulnerability is exploitable via a crafted input...