PT-2026-81192

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

JetBrains TeamCity < 2019.2.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session. CVE-2020-11688 - In JetBrains TeamCity before...

CVE-2026-19851: Use of Default Password

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

GHSA-JM48-M3RR-9HGG 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

CVE-2026-78381

RansomLook is vulnerable to arbitrary file read via a path traversal flaw in the screen field of group posts. The GroupPost.get API handler concatenates the database-stored screen value directly with the application's source/ directory without verifying the resolved path stays within that directo...

Malicious Package

Overview css-import-order is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-80870

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

PT-2026-81272

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution versions prior to 4.9.5 Description An issue exists where the rum importer function is registered on the WordPress core import start action hook without a...

PT-2026-81034

Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated user can perform arbitrary file deletion through the import link function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerabilit...

MAL-2026-14371 Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

SUSE CVE-2026-76018

Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted file. Chromium security severity: High...

PT-2026-79502

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.25 Description The plugin is susceptible to unauthorized data modification leading to privilege escalation. This occurs because the wpematico import settings function lacks a proper capability...

Linux Distros Unpatched Vulnerability : CVE-2026-76018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

EUVD-2026-64148

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-30890 Combodo iTop: Reflected XSS in synchro/synchro_import.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...