CVE-2026-108579

OpenPanel versions through 2.3.0 are vulnerable to a CSV formula injection vulnerability via the Cohort Member Export feature. Unauthenticated attackers can supply crafted profile IDs (e.g., =HYPERLINK(...)) to the /track endpoint. When a cohort is exported to a CSV file, these embedded formulas ...

http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

CVE-2026-66247

The iControl software is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability. This flaw could allow a malicious website to execute cross-origin requests that include the victim's credentials. If exploited, an attacker could access and exfiltrate sensitive data within...

CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-79537

metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...

PT-2026-99479

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106 Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the...

PT-2026-98142

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description An issue exists in the StopWords::add function where user-supplied input is inserted into a SQL INSERT statement using sprintf without proper database escaping. This occurs specifically in the code...

Server-side Request Forgery (SSRF)

Overview @tauri-apps/plugin-http is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP plugin's redirect-following logic, which checks the URL scope only against the initial URL requested by the frontend and not against subsequent redirect hops. A...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

PT-2026-95092

Name of the Vulnerable Software and Affected Versions FairEmail versions prior to 1.2319 Description The ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but fails to completely sanitize untrusted message HTML. For hosts no...

CVE-2026-11864: Improper Neutralization of Data within XPath Expressions

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

PT-2026-83652

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

Server-Side Request Forgery (SSRF)

magicmirror is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled URLs and authentication parameters in the unauthenticated /calendar Socket.IO namespace, which allows an attacker to make arbitrary server-side requests, bypas...

CVE-2026-75130: Undefined Security Weakness

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...

MAL-2026-13623 Malicious code in @depup/aws-sdk__credential-provider-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

MAL-2026-12394 Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

CVE-2026-5651 Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...