CVE-2026-108887 JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...

CVE-2026-108881

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getTenantPackInfo handler. This vulnerability allows any authenticated user to access product pack membership data belonging to other tenants. By supplying a specific tenantId and fixed packCode values (such as...

CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

EUVD-2026-97055

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108867 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108858

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied apitoken from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded...

CVE-2026-108697

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403 check. Authenticated Pimcore users lacking resource permissions can request the...

cve-2023-32784

CVE-2023-32784 KeePass 2.X version 2.54 is susceptible to a vulnerability in which the master password may be retrievable from a memory dump of an unlocked KeePass database. This was assigned CVE-2023-32784 This program aims to retrieve the master password from a memory dump of a running KeePass...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

Malicious code in @coopeuch/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...

MAL-2026-17761 Malicious code in @coopeuch/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...

MAL-2026-17766 Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

CVE-2021-38314

CVE-2021-38314 Unauthenticated Sensitive Information Disclosure CVE-2021–38314...

Malicious code in @s4yhiitestpoc/r3-https (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

CVE-2026-108858

A flaw was found in lorax. The service writes caller-supplied API Application Programming Interface tokens from request bodies directly into router logs and tracing data. An attacker with access to system logs or telemetry backends can exploit this flaw to view other users' private authentication...

Malicious code in some-very-long-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c08ea2abb307f6ecb9a1896fcc3980e9a1eaf8b29044db67cd985654e1db16 The package is a stub whose main module exports a Proxy that returns a no-op for every property access, providing none of the functionality implied b...

Malicious code in cloudflare_module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242 Package [email protected] is a dependency-confusion lure targeting the cloudflare namespace. package.json declares scripts.postinstall: "node...