10705 matches found
MAL-2026-10525 Malicious code in @vite-mcp/vite-type (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9828d7f04091054759c65d427b8f9d7b2853a8a062f9ca261a37e0a0bbc231d0 Package @vite-mcp/[email protected] impersonates the legitimate vite package: package.json declares name '@vite-mcp/vite-type', author 'Evan You',...
PT-2026-58294
Buffer Overflow in the entry handler of the TraceEvent system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel...
CGA-9GV8-Q962-65H9
Bulletin has no description...
CVE-2026-15605 wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...
CVE-2026-15605
The vulnerability CVE-2026-15605 affects wandb 0.25.2.dev1, specifically the ArtifactManifestEntry.download path in wandb/sdk/lib/hashutil.py under Artifact Integrity Validation. The issue is described as the use of a weak hash due to manipulating the ArtifactManifestEntry.download, with the atta...
Cross-site Scripting (XSS)
Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Scripting XSS through the log entry renderer in admin/src/LogsPage.ts. An attacker can execute JavaScript in an administrator’s browser by submitting a failed login with a crafted username that is...
CGA-52RR-HPV6-5JXX
Bulletin has no description...
rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
SummaryEntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, \, or an...
PYSEC-2026-2971 rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
Summary EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A malicious noarch:python package can ship an info/link.json with an entry-point name containing .., /, , or an...
MINI-M93G-7JX3-2RR7
Bulletin has no description...
MINI-V5PV-5446-9WJ3
Bulletin has no description...
CVE-2026-57411
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aman CF7 Views Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views Complete Entry Management for Contact Form 7: from n/a through = 3.2.2...
EUVD-2026-43483
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aman CF7 Views Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views Complete Entry Management for Contact Form 7: from n/a through = 3.2.2...
CVE-2026-57411
The CVE-2026-57411 entry concerns the WordPress plugin cf7-views (Aman CF7 Views – Complete Entry Management for Contact Form 7) with a DOM-based XSS vulnerability due to improper neutralization during web page generation. Affected versions are up to 3.2.2. CVSS v3.1 base score is 7.1 (HIGH); att...
CVE-2026-57411 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aman CF7 Views Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views Complete Entry Management for Contact Form 7: from n/a through = 3.2.2...
MINI-PMHC-WC82-RQ3G
Bulletin has no description...
CVE-2026-12081
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.2 ) is vulnerable to PHP Object Injection . The root cause is a failure to restrict allowed PHP classes during the unserialization of attacker-supplied form-field values. This allows unauthenticated us...
CVE-2026-12081 Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator...
CVE-2026-12081 Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator...