EUVD-2026-44622

Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute. Whatever that binary does, it does as you, with your source, your SSH keys and your cloud...

MAL-2026-10672 Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7353f50ebadb90b9c561e3e70b53c89712bafd182fdc3eb16e536651b972092 gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credential harvesting, exfiltration...

Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin WP ERP versions = 1.17.5...

Improper Access Control

OpenCost is vulnerable to Improper Access Control. The vulnerability is due to missing authentication in the /serviceKey endpoint, which allows an attacker to overwrite the GCP service account key file remotely, leading to service disruption, credential theft, and potential privilege escalation...

SUSE-SU-2026:3002-1 Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.115 fixes various security issues The following security issues were fixed: - CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink bsc1267893. - CVE-2026-46173: exit: prevent preemption of oopsing TASKDEAD task bsc1267723...

CVE-2026-11580

The CVE covers Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to 2.4.17. The root cause is a missing per-object capability check in the post-duplication AJAX action, enabling users with Contributor-level access or higher to duplicate any post (regardless of owner, post t...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

Malicious code in @sauruslord/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c2cf2672d98396a7b66cb732741d269732f5faae72293ea46e06b879e7a45b Package name impersonates Open Whisper Systems' libsignal-node but ships unrelated code. On require of index.js, after a 1-second delay, install.js...

MAL-2026-10653 Malicious code in webpack-session-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10646 Malicious code in @bcs-mi-ui/message-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c86304011c297c4b10092f83a6dc1763b8174e91fd9e81f8487b959ecea539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-15029

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protection...

CVE-2026-15030

Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request that bypasses the validation. Refer to the ' Security...

CVE-2026-13585

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe...

EUVD-2026-44589

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protection...

CVE-2026-15029

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protection...

CVE-2026-15029

The CVE-2026-15029 entry covers an Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager. The vulnerability permits a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests...

CVE-2026-15030

The CVE-2026-15030 entry concerns ASUS components: System Control Interface v3, System Control Interface, and ASUS Business Manager. The weakness is an out-of-bounds read caused by a crafted IOCTL request that bypasses validation, enabling a local administrator to read memory regions beyond the i...