Malicious code in idlive-face-capture-web-development (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which...

CVE-2026-110909

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

CVE-2026-110909

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

CVE-2026-110909

The Wheels CLI versions through 4.1.0 contains a vulnerability where it fails to verify that the local development server responding to its HTTP requests belongs to the current project. This improper restriction of communication channel allows a process listening on a targeted local port to inter...

EUVD-2026-101817

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

A Bootiful Podcast: Can Java be more performant than Rust? Andrew Lombardi has the numbers

Hi, Spring fans! What happens when a longtime Kotlin and JVM fan - my friend Andrew Lombardi - decides to take on the latest “rewrite everything in Rust” hype with AI in the driver’s seat? In this episode, Josh sits down with community legend Andrew Lombardi for a fast, funny, and deeply technica...

CVE-2026-110909: Improper Restriction of Communication Channel to Intended Endpoints

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682

The pipecat-ai Python framework (versions 0.0.98 to 1.6.0 ) contains a vulnerability where the built-in development runner exposes unauthenticated endpoints, including /start, /daily, and /daily-dialin-webhook. These endpoints allow unauthenticated callers to create bot sessions and Daily rooms ,...

CVE-2019-5420

CVE-2019-5420 Ruby-on-Rails offers three different environments it can run in: development, test and production. You should obviously not have code running in development or test available on the internet but it as always happens for example in staging environments. Ruby-on-Rails uses...

CVE-2026-102682: Insufficient Verification of Data Authenticity

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-55695

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...

CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...

CVE-2026-55695

FearlessCMS versions 0.1.2b and earlier are vulnerable to Remote Code Execution via an unvalidated Git repository URL in the system updater. An authenticated administrator can provide an arbitrary URL through admin/updater-handler.php, which is then passed to update.sh. The updater clones this re...

DevTools Suite DoS

The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

DevTools Suite DoS

The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge is related to the lack of security mechanisms to protect protected information. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

DevTools Suite Compromise

The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information through a specially crafted HTML page...