CVE-2026-33434

CVE-2026-33434 affects Wazuh 4.6.0+ up to 4.14.5. A logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When global max_request_per_minute is exceeded, /events requests can still succeed if the even...

CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

CVE-2026-43977

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exis...

CVE-2026-62963

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...

CVE-2026-44981

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed...

GHSA-48QW-824M-86PR ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Impact A user holding only reader read-only privileges on a single database could execute arbitrary JVM code by sending a "language": "js" command to the POST /api/v1/command/database HTTP endpoint, and use it to read arbitrary files on the host filesystem e.g. /etc/passwd, configuration files,...

CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

MAL-2026-10709 Malicious code in @cyberrant-rantai/rantai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d1dbf6fb83f9a7c4c4b94ee40255e86910714400e249fec55b031e809c92bd runtime/localagent.py opens a Socket.IO client connection to a hardcoded server at https://app.cyberrant.org overridable via $SERVERURL and registers...

MAL-2026-10736 Malicious code in memtry-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11638a6b1b7876a94ef23285cb88f0127c003bb5e4d786dbaba5c30a9cbdfdb7 memtry-cli installs an MCP server whose memtryonboarding tool returns a prompt that instructs the connected AI agent to scan the installer's home...

MAL-2026-10744 Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 101e7bafc335a4ccaf6418355dc242911c639482ce71a8b1f22b75bbdbb8af7e The package's Gemini driver at dist/drivers/gemini/index.js line 53 contains a curl invocation against a host literally named 'attacker' curl...

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5 The pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a...

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee The package advertises itself as a REST client for a captcha-solving API, but the shipped captchasolveapi module is a 20-line stub. The tarball's rea...

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee The package advertises itself as a REST client for a captcha-solving API, but the shipped captchasolveapi module is a 20-line stub. The tarball's rea...

MAL-2026-10733 Malicious code in idlive-document-capture-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d428a1956dd86e85bfb6fb83cba2dea11bfc19250c1262d13a88c3bdd8ca07e0 Package name typosquats the legitimate 'idlive' family and ships no library functionality. package.json declares a preinstall lifecycle hook...

MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

CVE-2026-46515

CVE-2026-46515 (Frogman) affects Frogman’s headless PBX control via MCP and HTTP API. Before version 1.6.3, a PERM_READ privilege was sufficient to call multiple endpoints (fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query...

CVE-2026-46515 Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

CVE-2026-63087

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-44596

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attack...