28 matches found
CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...
CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...
CVE-2026-56274
Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions f...
PT-2026-41137
Name of the Vulnerable Software and Affected Versions wger version 2.5.0a2 Description A logical error in the permission check allows an authenticated gym trainer to escalate privileges to a gym manager or general manager account. By chaining two calls to the trainer-login endpoint, a trainer can...
CVE-2026-39418 MaxKB: SSRF via sandbox network hook bypass
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto with the MSGFASTOPEN flag. This allows authenticated user with tool-editing permissions to reach internal services that are explicitly blocked by the...
Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2026-1442)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1442 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...
Important: runc
Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: runc Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to...
CVE-2019-20870
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID...
MAL-2025-188437 Malicious code in ophiuchus-callisto-semantic-ui-lynx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d65af75f6acff48d55a94e31741a5da41d9e26f8b607169d254ab4d96271cb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-138348 Malicious code in yuni-gepuk62-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d3c1471b8cb2d019f0999d9670a1996c10891f291dde408f050b5a62ff7eeac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in kurniawan-serimuka53-ruro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53cefd0a0194a3acff1238ccee1f8ad737da6592244f9c8e370641d1174b0368 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-86124 Malicious code in hadi-gulai35-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9819ab3ca2bc12b78c7f8865dc00f0bbb67098e00e21e7a5120c837fdca4a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in jaja-keraktelor20-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c3b64280c053d4b4ed3bdb0424c39d01143276f9e68402d3dc165367e2c300 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in ocha-kentang19-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cffe97775827d2b810ac9496a19a241cc8d437158c9cf7b7fb2adec246887e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-79289 Malicious code in joni-getuk73-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e939c87dd4357233c0c6a25107d53aa8cedcc41481fe4f20136aa6cba57fe6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-80005 Malicious code in melted_reindeer_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bc760e8a075e7dde90426a750b0a221085e13f63b6bc0d9618d927ba08d1a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in bambang-asinan57-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca87313d6dacf58ad6783fec9365c7ce40acaaa917b54b6d24acfc8376ff9fee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in clumsy-white-amphibian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5cab4f4e1e4901e5bf0b3ba11962e9d76641981b82e748f705204191d801f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-65843 Malicious code in utomo-naget96-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e829c567f6c4926e2db856ac3d0eb1e291d4d33a90be8a237ab2834160d87f32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
