8683 matches found
SUSE-SU-2026:23455-1 Security update for wget
This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962...
Malicious code in controlled-green-crab (npm)
Source: amazon-inspector 85f3075d4b1b291d4dc8e40aaa85da5687cff4a209b910da38f9630cb5b19bc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in controlled-chocolate-seahorse (npm)
Source: amazon-inspector 9d38bb5101ecb2fe4779b028380da698f7dedc4fa252a78d2e1894af203b16de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
EUVD-2026-70795
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-70796
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
CVE-2026-85617: Authorization Bypass Through User-Controlled Key
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions...
Malicious code in orbitron-cli (npm)
The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...
PT-2026-85435
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...
Debian dla-4772 : libpcre2-16-0 - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4772 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4772-1 [email protected] https://www.debian.org/lts/security/...
CVE-2026-85408: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/ /events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack...
CVE-2026-83711
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69857
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
GHSA-63MC-HW7G-86RR Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
Summary The Phoenix JavaScript presence client assets/js/phoenix/presence.js tests whether a presence already exists using a bare truthiness check statekey rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can...
Malicious code in @modss/baileys (npm)
@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published 2026-09-01 and 2026-09-02 under a scope created the same day. lib/Socket/newsletter.js sets NEWSLETTERLISTURL to https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json. On every connection.update with...
CVE-2026-85308
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5...
CVE-2026-85308
Brainstorm Force SureForms , a WordPress plugin, is affected by an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in versions from n/a through 2.12.5 . The flaw allows exploitation of incorrectly configured access control security levels, meaning an unauthenticated remote a...
CVE-2026-85308 WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5...
EUVD-2026-70552
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5...