MAL-2026-14493 Malicious code in svelte-daily-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e6392583e46c5137935ed3fb8e29feab51a88b0ddafaf033a27962f8588130 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-70763

Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite component: Daily Business Intelligence. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

EUVD-2026-61714

Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite component: Daily Business Intelligence. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

PT-2026-77758

Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite component: Daily Business Intelligence. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

MAL-2026-12461 Malicious code in streak-daily-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...

Malicious code in streak-daily-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...

CVE-2026-16276

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

CVE-2026-16276

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

EUVD-2026-52164

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

CVE-2026-60004

creationtimestamp| type| source ---|---|--- 2026-07-29 07:59:42+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrrhfbohdx2w 2026-07-29 08:02:34+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrrhkep54z23 2026-07-29 09:00:07+00:00| seen|...

MAL-2026-11150 Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...

CVE-2026-53921

creationtimestamp| type| source ---|---|--- 2026-07-28 13:07:19+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrpi4ffu7a2v 2026-07-28 14:29:22+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrpmp3yu3d2v 2026-07-28 14:58:13+00:00| seen|...

Modeling Local Exploit Hazard - a Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency

This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model ELM, such as the Exploit Prediction Scoring System EPSS, into a daily exploit hazard rate for an organization's own assets. The model measures the...

CVE-2026-50130

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root...

CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root...

Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling

Meta has filed a patent application for an AI that listens to your voice throughout the day, works out how it thinks you are feeling from the way you sound, and keeps a timestamped log of every read. Each read gets pinned to the moment it happened: the time, your location, what you were doing, ev...

CVE-2026-32712

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting XSS vulnerability exists in the Daily Sales management table. The customername column is configured with escape: false in the bootstrap-tabl...

EUVD-2026-28526

UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic flaw in its policy enforcement pipeline. When a transaction originates from a "Pocket" a derived sub-address documented in the protocol a...

exploitdb

The Exploit Database Git Repository This is an official repos...

PT-2026-35739

The Aranda File Server AFS component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls...