Malicious code in bcc-design-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ef58a44d6da495f8f9cd06686303901d391069000f5a10d09694b68241e2 [email protected] declares a postinstall script node./notify.js that runs automatically on npm install. The script performs an HTTP GET to th...

Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

MAL-2026-14121 Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-11801

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-60568

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-11801 WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-60548

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

EUVD-2026-60542

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

EUVD-2026-60511

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state...

PT-2026-77825

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-77811

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials...

PT-2026-77968

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

PT-2026-77828

Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Landed...

PT-2026-77454

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Oracle Identity Manager Connector version 12.2.1.4.0 Oracle Fusion Middleware Oracle Identity Manager Connector version 14.1.2.1.0 Description A flaw in the Connectors and Connector Server component allows a high...

PT-2026-77437

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker with access to the physical...

PT-2026-77395

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 17.0 through 26.6 Description A flaw in the REST component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access...

PT-2026-77633

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Customer Care versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Customer Care allows a high privileged attacker with network access via HTTP to compromise the syste...

PT-2026-77558

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Purchasing versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-77639

Name of the Vulnerable Software and Affected Versions Oracle Reports Developer version 12.2.1.19.0 Description A security and authentication issue exists in the Oracle Reports Developer product of Oracle Fusion Middleware. An unauthenticated attacker with access to the physical communication...

PT-2026-78055

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description An issue exists in the CAX Client component of the Oracle Agile PLM MCAD Connector. An unauthenticated attacker with access to the infrastructure where the software executes can compromis...