MAL-2026-2329 Malicious code in @abi-labs-frontend/standards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60eba79d2fd49b58fb2a2073d2b7c87f66c1ad781bc1a6137962f9b5e772449 The package @abi-labs-frontend/standards was found to contain malicious code...

CVE-2026-33334

Summary (CVE-2026-33334): Vikunja Desktop Electron wrapper prior to 2.2.0 enables nodeIntegration in the renderer without contextIsolation or sandbox, turning any web frontend XSS into full remote code execution on the victim’s machine. Affected range: Vikunja 0.21.0 through 2.1.x (up to

CVE-2026-33334 Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting XSS vulnerability in...

PT-2026-27476

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated attacker can exploit the 'validate' action in the Frontend to blindly instantiate arbitrary PHP classes. The impact of this issue depends on t...

WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin WP User Frontend versions = 4.2.8...

Advisory ROSA-SA-2026-3252

software: grafana 12.1.8 WASP: ROSA-CHROME unaffected versions = grafana-12.1.8-1 affected versions 3s, timeout and permanently block on sending to an unbuffered channel, resulting in linear growth of goroutines and memory exhaustion. CVE-STATUS: The vulnerability has been resolved CVE-REV: To...

MAL-2026-1768 Malicious code in legacy-shared-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bdad0c7ae6723e92b1d0bc357ec0ed147ccb057cba4fc6cff4a2a26d7cc967 The package legacy-shared-frontend was found to contain malicious code...

Malicious code in legacy-shared-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bdad0c7ae6723e92b1d0bc357ec0ed147ccb057cba4fc6cff4a2a26d7cc967 The package legacy-shared-frontend was found to contain malicious code...

Malicious code in ersagent-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daad6f453576f7151fc8a9260bb07623621adfa308616bbe4f5b88f9eabe0d4 The package ersagent-frontend was found to contain malicious code...

MAL-2026-1726 Malicious code in ersagent-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daad6f453576f7151fc8a9260bb07623621adfa308616bbe4f5b88f9eabe0d4 The package ersagent-frontend was found to contain malicious code...

MAL-2026-1709 Malicious code in dnsfilter-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fbe7b6607030de1223e6c9beb7c21f7c5bafbbf72cdceb41d8eee9105b6e3e The package dnsfilter-frontend was found to contain malicious code...

Malicious code in dnsfilter-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fbe7b6607030de1223e6c9beb7c21f7c5bafbbf72cdceb41d8eee9105b6e3e The package dnsfilter-frontend was found to contain malicious code...

CVE-2026-27894

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with...

WordPress User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Modification via 'postid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP User Frontend versions = 4.2.8...

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

Summary In Central Browser mode, the /api/4/serverslist endpoint returns raw server objects from GlancesServersList.getserverslist. Those objects are mutated in-place during background polling and can contain a uri field with embedded HTTP Basic credentials for downstream Glances servers, using t...

EUVD-2026-12202

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draftpost function in all versions up to, and including, 4.2.8. This makes it...

WordPress plugin User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-25537

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft post function in all versions up to, and including, 4.2.8. This makes it...

Incorrect Authorization

Overview chrome-devtools-frontend is a Chrome DevTools UI Affected versions of this package are vulnerable to Incorrect Authorization via insufficient enforcement of navigation policies in the DevTools process. An attacker can access restricted resources or perform unauthorized navigation by...

EUVD-2026-11085

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend...