CVE-2026-109177

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109165

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-108889

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access...

Malware in @pinecone-experience/messages

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in unified-platform

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in risk-detection

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2026-97381

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109177

MoguBlog versions up to and including 6.2 are vulnerable to a broken access control flaw. The issue stems from a lack of admin_uid checks when processing specific requests, allowing authenticated administrators to move or rename network-disk files belonging to other administrators. By sending cra...

CVE-2026-109177 MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-109165 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

EUVD-2026-97371

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-109165 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-109165

The TDuck survey form (through version 6.0 ) is vulnerable to a broken access control issue (CWE-639) in the POST /user/form/item/batch/create endpoint. This flaw allows authenticated users to inject arbitrary fields into other users' forms by submitting an array where the first element reference...

Malware in webpackbootstrap5

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2026-97368

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access...

CVE-2026-108889

A flaw exists in Yungengxin Cloud Billing 2024.11.28.11 affecting the IOCTL Process Termination component. Specifically, the function sub_14000443C within the LWBilling64.sys library is vulnerable due to insufficient access control when the Pid argument is manipulated. This vulnerability can be e...

Malware in @tesla-insurance/vinless-quote

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CLSA-2026-1791809045 sssd: Fix of 2 CVEs

CVE-2026-90462: deny access in sdapaccessppolicystepdone when the LDAP ppolicy user search returns zero entries, instead of returning success and caching an allow decision - CVE-2026-90996: reject an empty request body in the NSS responder request parsers before bodyblen - 1 is read...