Malicious code in @amber-team/export-events-to-sheet (npm)

The package @amber-team/export-events-to-sheet was found to contain malicious code. --- Credit: OpenSSF source...

Malicious Package

Overview @amber-team/export-events-to-sheet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

GHSA-3R53-75J5-3G7J Quasar: Prototype pollution in the extend() utility

Summary [email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend utility exported from the package root. When extendtrue, target, source is used for a deep merge, attacker-controlled object keys are recursively...

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cluster Export Services (CES) S3 are now addressed in 5.2.3.9 or higher and 6.0.1.0 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale IBM Storage Scale Cluster Export Services CES S3 and could provide weaker-than-expected security, are now addressed in Storage Scale 5.2.3.9 or higher or 6.0.1.0 or higher. Vulnerability Details CVEID:CVE-2026-25680...

PT-2026-67000

Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.3 Description High-privileged users can read arbitrary files on the server because the plugin does not restrict the file path during a CSV import process...

CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

EUVD-2026-48243

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607

SiYuan before v3.7.2 has a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). The branch concatenates the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath check...

PT-2026-63973

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description An authenticated attacker can exploit a path traversal issue in the /export/temp/ endpoint within the serveExport handler located in kernel/server/serve.go. The vulnerability exists because the...

PT-2026-64074

Summary An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services. Details The export getRequestCountersWeb function is callabl...

Glances Cassandra Export Code Execution

The vulnerability of the Cassandra export module in the Glances monitoring tool’s application programming interface is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2026-63684

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...

CVE-2026-63684

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...

CVE-2026-63684

Multiple Regular Labs extensions for Joomla are affected by inconsistent CSRF token checks , privilege checks, and input-validation across various administrator actions, editor popups, and import/export requests. Due to these deficiencies, unauthorized backend users or Cross-Site Request Forgery ...

CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...