CVE-2026-69127

Kirby (open-source CMS) has a REST API flaw where, prior to 4.9.5 and from 5.0.0 through 5.5.1, the API error handler can return unsanitized PHP error messages that reveal the full filesystem path of the Kirby installation to unauthenticated API users. The issue affects all sites that have not di...

Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

EUVD-2026-54275

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

Malicious code in rdfxvela-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef19b46ba2f8a9d7a30bedb44d2e45903d5e4e905d736b5ce5c20cbb0b77be12 The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-time code fetch and execution...

MAL-2026-13493 Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

The vulnerability of the context Isolation mechanism of the software platform for creating Electron applications allows a attacker to gain full access to the system.

The vulnerability of the context isolation mechanism of the Electron application development platform is related to the breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to gain full access to the system...

CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

MAL-2026-13475 Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032

CVE-2026-17032 concerns Supsystic Multiple Pro Plugins. The issue arises from a vendor update server compromise, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and sensitive data and grants full control of affected sites. The records indicate a cr...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

EUVD-2026-53921

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Full Stripe Free versions = 8.5.0...

CVE-2026-1728

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

EUVD-2026-53821

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...