CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

Malicious code in export-decompress-integer-encrypt-void (npm)

Source: amazon-inspector 28695760d083f5e2fcbad0256e0d7bcd97eb380a6817997d836fdb188c1733e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in export-gltf (npm)

--- Credit: OpenSSF source...

Malicious code in export-double-cache-benchmark-resolve (npm)

The package export-double-cache-benchmark-resolve was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in export-zero-orchestrate-zero-compile (npm)

Source: amazon-inspector 5af09b797e4f7aae7c05dba3d89244c143d4393bfb4489b7d6453160dc763868 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in export-route-kernel-wind-big (npm)

The package export-route-kernel-wind-big was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in export-resolve-theta-slow-refactor (npm)

Source: amazon-inspector 38a82e294ea324bca472096d25a02a11bb79c13ed4c1729e7d4735c3cf05ccf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in export-bad-compress-fork-compress (npm)

Source: amazon-inspector 2450caad5f166bccaedd001fd246098f519b199e4d01210149d86eda62fed676 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in export-psi-zeta-upsilon-balance (npm)

Source: amazon-inspector 89f1ef51d519c74b84c078dc5bf56f9e105291710857d19dda790846f4d0bccd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in export-hot-cold-orchestrate-awk (npm)

Source: amazon-inspector e29679a768cff74bff87249c600a87ea07ac325f73af6665e836040a9722c178 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in encode-route-deserialize-eta-export (npm)

Source: amazon-inspector a4849f20d06c8c3eb71f943fcebe44c6e682e2c94299b7465ea7d58fde0889c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

django-easy-quiz (>=4.0.1, <=4.2.0), memfs (>=0.1.6, <=0.1.8) +2 more potentially affected by CVE-2026-55073 via weasyprint (60.1.0)

weasyprint PYPI version 60.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - django-easy-quiz =4.0.1, =0.1.6, =0.1.0, =0.2.1 - proj2pdf 0.1.0 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

PT-2026-89414

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convert markdown to pdf module. The attribute, objectAttribute,...

django-easy-quiz (>=4.0.1, <=4.2.0), memfs (>=0.1.6, <=0.1.8) +2 more potentially affected by CVE-2026-55073 via weasyprint (60.1.0)

weasyprint PYPI version 60.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - django-easy-quiz =4.0.1, =0.1.6, =0.1.0, =0.2.1 - proj2pdf 0.1.0 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the unacceptedassets report process. An attacker can obtain sensitive inventory details and assignee names belonging to...

Information Exposure

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Information Exposure via the CSV export and API index endpoints due to improper enforcement of authorization checks. An attacker can access sensitive license key information...

CVE-2026-86758

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86758

Snipe-IT versions prior to 8.7.0 contain an authorization bypass in the CSV export and API index endpoints. The application fails to properly enforce the viewKeys authorization gate, allowing any authenticated user with only the licenses.view permission to access product keys —a permission level ...