MAL-2026-10569 Malicious code in temp-cloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec75c040be8d9901d8715cc65309341f95b497d35062ea6014b7e4a36b35ff89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10559 Malicious code in avatar-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79e52ebdc93b154163545b64642ea4c4016c4a69692c6f9e20e283cce3842770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lusha-iam-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46142505b88a255674663ced6e8bce8c8f3e28c0936e463e07463a7e1331e5af package.json declares the node-fetch dependency pinned to a tarball URL on registry.ctzbg.com, a host unrelated to the npm registry and unrelated to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

CVE-2026-44747

creationtimestamp| type| source ---|---|--- 2026-07-14 00:54:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkymgc6gn2r 2026-07-14 02:27:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mql5t5mr6v2x 2026-07-14 03:00:30+00:00| seen|...

PT-2026-58082

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the...

PT-2026-58219

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

PT-2026-58246

Name of the Vulnerable Software and Affected Versions SQL Server versions 2016 through 2025 Description An authorized attacker can elevate privileges locally due to external control of a file name or path. This allows an authenticated local user to gain administrative control over the database...

CVE-2026-9128: Unquoted Search Path or Element

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

CVE-2026-50462: External Control of File Name or Path

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-54108: External Control of File Name or Path

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-45071: Improper Restriction of XML External Entity Reference

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...

PT-2026-58901

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...

IBM API Connect SQL Injection Vulnerability (CNVD-2026-29413)

IBM API Connect is an integrated platform for managing APIs developed by IBM Corporation in the United States. IBM API Connect has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements during the password reset function. Attackers can...

PT-2026-58025

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...

PT-2026-58712

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Adobe Media Encoder affected versions not specified Description Adobe Experience Manager and Adobe Media Encoder are affected by an Improper Restriction of XML External Entity Reference...

PT-2026-58083

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

PT-2026-58032

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

CVE-2026-55002: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...