58270 matches found
MAL-2026-10713 Malicious code in @hibachi-xyz/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...
Malicious code in @hibachi-xyz/sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...
CVE-2026-35149
CVE-2026-35149 involves HCL DFXServer and describes an authentication bypass caused by server response manipulation. The vulnerability allows an unauthenticated attacker to gain access by intercepting and altering authentication responses, effectively bypassing verification. Reported CVSS-3.1 met...
CVE-2026-15103
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the updatesettings REST callback failing to validate the groupid path...
CVE-2026-15103
The CVE affects the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell WordPress plugin. All versions up to 3.12.8 are vulnerable to privilege escalation via an insecure update_settings() REST callback that does not validate the group_id path parameter against an allowlis...
CVE-2026-50144
A flaw was found in ncnn, a high-performance neural network inference framework. A remote attacker could craft a malicious model file that, when processed by a user, triggers an out-of-bounds heap write. This vulnerability in the ncnn::ParamDict::loadparam function is caused by insufficient...
MINI-4QJ2-P73Q-CWMM
Bulletin has no description...
MINI-JVG9-5MQX-H8RH
Bulletin has no description...
EUVD-2026-44894
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pricewrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-53366
creationtimestamp| type| source ---|---|--- 2026-07-16 07:43:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqgthqbh2s 2026-07-16 17:31:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930842680877521 2026-07-20 17:28:37+00:00| seen|...
BELL-CVE-2026-40553
Bulletin has no description...
CVE-2026-28603
creationtimestamp| type| source ---|---|--- 2026-07-16 04:46:27+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260716...
CVE-2026-52960 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu...
How to Export Veeam Backup for Salesforce Data to Cloud or Local Storage
This article was updated on 2026-08-21 to document the new vbsf-export 1.0.0-27, which introduces support for export to local storage in addition to the previous cloud-only destinations. Purpose This article covers vbsf-export, a standalone utility that exports Salesforce backup data from a Veeam...
PT-2026-60451
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified AWS Cognito affected versions not specified Microsoft Entra ID affected versions not specified Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA...
openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21339-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21339-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py...
CVE-2026-53447
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...
CVE-2026-55398
creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:21+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptm4mdb2w...
CVE-2026-53447
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...