CVE-2026-73394

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

CVE-2026-73394 WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

EUVD-2026-62371

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

CVE-2026-73394

The WordPress Stitch Express plugin (versions ≤ 1.9.0) has an unauthenticated broken access control flaw exploitable over the network with no credentials (CVSS 7.5, HIGH), allowing unauthorised integrity changes; no patch version or exploit details are provided in the documents.

WordPress Stitch Express plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Stitch Express versions = 1.9.1...

CVE-2026-73394: Missing Authorization

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

PT-2026-78349

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

exp-labs

exp-labs Cybersecurity Training Platform This modern web secu...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-68372

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

Malicious code in chai-as-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953 The package presents itself as a chai-related utility name chai-as-map, keywords logger/stream/json, description referencing vulnerability management...

EUVD-2026-55520

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68139

CVE-2026-68139 affects the Linux kernel mlx5e/MPV path. After PCIe DPC recovery, mlx5 reloads affected PCIe functions and replays multiport affiliation events; during resume, an RDMA multiport binding replay triggers an MPV_DEVCOM_MASTER_UP. The host panics with a NULL pointer dereference in mlx5...

Malicious code in @decido/backend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8 The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware...

MAL-2026-13621 Malicious code in @decido/backend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8 The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware...

Cisco IOS XE Information Disclosure

The vulnerability of Cisco IOS XE operating systems is related to incorrect calculations. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...