MAL-2026-15849 Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

MAL-2026-15851 Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

MAL-2026-15854 Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

MAL-2026-15848 Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

CVE-2026-85156 WWBN AVideo Broken Access Control via Channel Page

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

CVE-2026-85156 WWBN AVideo Broken Access Control via Channel Page

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

CVE-2026-85156 WWBN AVideo Broken Access Control via Channel Page

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

EUVD-2026-70391

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

CVE-2026-38577-by-deepak-Anmol

CVE-2026-38577 — Tenda HG21 Hardcoded Root Credentials Summary Field| Value ---|--- CVE ID| CVE-2026-38577 Vendor| Tenda Product| Tenda HG21 XPON Fiber Modem Affected Version| V4.0.0-260302 Product Key| HG21-V1.0-TDE01 Hardware Version| V1.0 Firmware Build Date| 2026-03-02 Firmware File|...

PT-2026-84988

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

CVE-2026-8862: Insufficiently Protected Credentials

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code,...

CVE-2026-85391: Use of Hard-coded Credentials

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

CVE-2026-85156: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

PT-2026-85224

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

Tenda HG21 Hardcoded Root Credentials

Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded administrative account baked into the shipped firmware image. The account is granted full root privileges UID 0 and its credentials are static across devices, meaning any attacker who can reach an exposed management service...

PT-2026-85255

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code,...

CVE-2026-84809

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-2688

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...