Malware in ionic-youtube-search

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in p12-pem

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3272 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

PT-2026-122971

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.30.11 Description An authorization bypass allows owners or administrators of any organization to control applications belonging to other tenants by providing foreign applicationId values. This allows unauthorized...

SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

Missing project context can prevent build-dependent analyzers from constructing program relations required for vulnerability detection, while neural predictions alone do not establish auditable derivations. We present SymLift, a compile-free framework centered on Vulnerability-Oriented Neural...

Repairing Broken Access Control in Web Applications with LLMs: An Empirical Benchmark Study

Broken access control BAC ranks among the most severe web-application vulnerability classes, yet its automated repair remains largely unexplored. Unlike memory-safety vulnerabilities, BAC is a logic vulnerability whose repair demands a deep understanding of an application's access-control model a...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2026-3271)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3271 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2 : oci-add-hooks (ALASECS-2026-147)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-147 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when ...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-3228)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3228 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2026-146)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-146 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3270)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3270 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

[SECURITY] [DLA 4857-1] caddy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4857-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 24, 2026 https://wiki.debian.org/LTS -...

GHSA-jpc4-w9r8-43j3

GHSA-jpc4-w9r8-43j3 — Statamic unauthorized arbitrary-extensio...

CVE-2026-114192

Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8...

CVE-2026-114191

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

CVE-2026-114191 WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

CVE-2026-114191

The UPI QR Code Payment Gateway for WooCommerce plugin (versions up to 1.6.3 ) is affected by a Missing Authorization vulnerability. This flaw stems from Incorrectly Configured Access Control security levels, allowing for the exploitation of broken access controls. The impact is characterized by ...

EUVD-2026-109298

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

CVE-2026-114192

The WpEvently WordPress plugin by Magepeople inc. is vulnerable to a Missing Authorization (CWE-862) flaw. This Broken Access Control vulnerability occurs because the software allows exploitation of incorrectly configured access control security levels. The issue specifically affects versions up ...