MAL-2026-13821 Malicious code in mnchfnvbue1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff948b6e989a38a47cbb12d4e633d48a2069c04bb64066d66140f3b27835ef86 The tarball contains a single file, index.html, declared as the package main. The HTML contains heavily obfuscated JavaScript that mimics a Cloudflar...

MAL-2026-13817 Malicious code in jhkxcixudnvm1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aecafeb32fc0bc6beb0fcd9f6cab36efa71c8e69dc966271eea55bd03ba8eadf The package contains only package.json and index.html, with index.html declared as main. The HTML imitates a Cloudflare 'Just a moment...' verificati...

MAL-2026-13783 Malicious code in bcnfjndwbkf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1fc1ec45930a69372eadc47b662c5d82b247b5b4227feacda3d1c4302b4bf3 The package contains only index.html and declares main: 'index.html' with no scripts, no bin, and no JavaScript library surface. The HTML mimics a...

MAL-2026-13846 Malicious code in yangming8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c011964f9503dad45858ba2fdd5de1303275d7a0a680e2c482c3e14d90c4e33c The tarball's only shipped file is index.html, declared as the package's main. There are no lifecycle scripts, no JavaScript entry point, no...

MAL-2026-13818 Malicious code in jkbnwsdf8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358 The package contains a single file, index.html, declared as the package main. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challen...

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

CVE-2026-64955

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

EUVD-2026-57158

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955

CVE-2026-64955 describes that when Microsoft Excel imports a CSV file, it may execute cells beginning with certain characters as formulas, enabling arbitrary execution. The advisory associates Velociraptor’s CSV export paths (GUI, offline collector, data exports) as the context, indicating Veloci...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities primarily involve incorrect authorization, which allows attackers with varying privilege levels to circumvent security checks. This enables attackers to obtain unauthorized read and write permissions, access...

CGA-7H9F-9CJ5-242V

Bulletin has no description...

CVE-2026-73249

A flaw was found in the calibre Content Server. This vulnerability allows a remote attacker, including unauthenticated users, to bypass authorization checks when interacting with the /book-update-annotations endpoint. By sending specially crafted JSON data, an attacker can modify book annotations...

CVE-2026-19073

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase...

CVE-2026-16737

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-16253

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...