Decidim's private data exports can lead to data leaks

Impact Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs. The bug was introduced by 13571 and affects Decidim versions 0.30.0 or newer currently 2025-09-23. This issue was discovered by running the following spec several times...

EUVD-2020-30934

OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting XSS attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For...

CVE-2020-36945

WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials. Attackers can inject the payload '' OR '1'='1' in both username and password fields to gain unauthorized access to...

com.foxinmy:easemob4j (>=1.1.0 <=1.1.3), com.foxinmy:umeng4j (>=1.1.0 <=1.1.3) +13 more potentially affected by CVE-2026-24819 via com.foxinmy:weixin4j-base (>=1.0 <=1.9.1)

com.foxinmy:weixin4j-base MAVEN version =1.0, =1.1.0, =1.1.0, =1.9.0, =1.4, =1.0, =1.9.0, =1.4, =1.0, =1.8.0, =1.0.9-RELEASE, =0.0.2, =0.0.3 - org.oxerr:spring-security-wechat-samples-helloworld =0.0.1 Source cves: CVE-2026-24819 Source advisory: SNYK:JAVA-COMFOXINMY-15128702...

Malicious Package

Overview mapkit-example-vue is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mapkit-example-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e50c0bfa7ac259128381d1495bc907b68e4721214789ed3316c0a57e387175 The package mapkit-example-svelte was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview mapkit-example-svelte is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mapkit-example-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a99b2a1b5d1181c18ff26056481018d107fc6fc38df563e0d7fba6aa44b7cd51 The package mapkit-example-vue was found to contain malicious code. Source: ghsa-malware...

MAL-2026-524 Malicious code in mapkit-example-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a99b2a1b5d1181c18ff26056481018d107fc6fc38df563e0d7fba6aa44b7cd51 The package mapkit-example-vue was found to contain malicious code. Source: ghsa-malware...

MAL-2026-523 Malicious code in mapkit-example-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e50c0bfa7ac259128381d1495bc907b68e4721214789ed3316c0a57e387175 The package mapkit-example-svelte was found to contain malicious code. Source: ghsa-malware...

Exploit for CVE-2026-24061

CVE-2...

Malicious Package

Overview mapkit-example-vanillajs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Exploit for CVE-2014-0075

CVE-2014-0075PoC T...

CVE-2012-10064

Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions,...

Malicious code in mapkit-example-vanillajs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5930ccf1bb06110abd9daaa0441059f428ee853e926572c4c9416ba959401d53 The package mapkit-example-vanillajs was found to contain malicious code. Source: ghsa-malware...

MAL-2026-327 Malicious code in mapkit-example-vanillajs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5930ccf1bb06110abd9daaa0441059f428ee853e926572c4c9416ba959401d53 The package mapkit-example-vanillajs was found to contain malicious code. Source: ghsa-malware...

CVE-2012-10064

Omni Secure Files WordPress plugin versions before 0.1.14 contain an unauthenticated arbitrary file upload vulnerability in the bundled plupload example endpoint (upload.php). The handler does not enforce safe file type restrictions, allowing attacker-controlled files to be uploaded to the plugin...

PT-2026-3315

Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions,...

CVE-2025-23808

Cross-Site Request Forgery CSRF vulnerability in Dutch van Andel Custom List Table Example custom-list-table-example allows Reflected XSS.This issue affects Custom List Table Example: from n/a through = 1.4.1...

Resolutions, shmesolutions (and what’s actually worked for me)

Welcome to this week's edition of the Threat Source newsletter. I went to bed at 8:30 p.m. on New Year's Eve, and I think that's pretty indicative of how I approach the whole idea of New Year's resolutions. I love to count down to the new year with loved ones as much as the next person, but I hav...