Malicious code in dysonswarm-apex-graphql-module (npm)

Source: amazon-inspector 00edc1420ef60c8781c29b4cfa9b3d8d0e4928fb48176c0fabe627e881d70830 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dotenv-parse-variables-phoebe-procyon-graphql (npm)

Source: amazon-inspector 25727adf9796499061bfc2db2588d0ea8977bae2875b159d01c443e8a78f9aa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dendrochronology-graphql-betelgeuse-acamar (npm)

Source: amazon-inspector c12230401a2890b637b05550d901e8bcf53d8e9b4dd1151598bc395c866b8e7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in deimos-graphql-procyon-aurora (npm)

Source: amazon-inspector c04c5e0e69cc449de0674247a3157f77fd9436b0b2b13b415c65aa14f991fca9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the fl...

resterm v1.5.6

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is an API client that uses .http/.rest files as source code. Almost all the features live in .http files, so they are easy to review in Git or any other version control. You can send requests, test API flows, record HTT...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86176: Authorization Bypass Through User-Controlled Key

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

PT-2026-86400

Name of the Vulnerable Software and Affected Versions NetBox versions prior to 4.7.1 Description Authenticated users with view permissions can access private records of all users due to improper scoping of querysets. This issue affects the REST and GraphQL API endpoints for Notifications,...