EUVD-2026-83248

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

PT-2026-95578

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.55 Description An unauthenticated user with a public note share link can access project-wide collaborative editing metadata. This occurs because the public share consumer joins the same collaboration group as...

CVE-2026-33161

CVE-2026-33161 — Craft CMS : A low-privileged authenticated user could call the assets/image-editor endpoint with the ID of a private asset they cannot view and still receive editor response data, including focalPoint, due to missing per-asset authorization validation. Affected versions: 4.0.0-RC...

Malicious code in aiboa-miloipe-apomapai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6860927182dac798db7916c4c247956fb7c037c0a36ba449db8766dd2d9cddb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...