229485 matches found
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
The fix for CVE-2026-46339 unauthenticated RCE via unprotected MCP plugin routes introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes /api/mcp/, /api/tunnel/, /api/cli-tools/ to loopback requests. The gate determines "local" by inspecting the Host and...
MAL-2026-6782 Malicious code in @marketfront/header (npm)
The @marketfront/header package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
MAL-2026-6783 Malicious code in @marketfront/infopopup (npm)
The @marketfront/infopopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
ROS-20260702-73-0043
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
Malicious code in @marketfront/captchaservice (npm)
The @marketfront/captchaservice package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
PT-2026-55032
Subscriber Broken Access Control in Flatsome = 3.20.5 versions...
CVE-2026-38971
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...
PT-2026-55033
Contributor Broken Access Control in Flatsome = 3.20.5 versions...
PT-2026-55231
Name of the Vulnerable Software and Affected Versions UniFi Connect Application versions prior to 3.4.17 Description An improper access control flaw exists in the UniFi Connect Application. A malicious actor with network access can exploit this issue to execute arbitrary commands on the host devi...
PT-2026-55244
Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An Improper Access Control issue allows a network-based actor to bypass authentication for data streaming. Improper Access Control occurs when an application fails to proper...
CVE-2026-38971
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...
MAL-2026-6781 Malicious code in @marketfront/gotoauthpopup (npm)
The @marketfront/gotoauthpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
ROS-20260702-73-0077
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260702-73-0073
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260702-73-0040
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260702-73-0041
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260702-73-0062
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260702-73-0054
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...