389178 matches found
Malicious code in css-nesting-transform (npm)
[email protected] was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi the same account that published [email protected] on 2026-10-06. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of...
Malicious code in ap3-foundations-ui (npm)
Source: amazon-inspector 7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477 The package's preinstall hook runs index.js, which collects installer host identifiers os.hostname, os.userInfo.username, os.homedir, process.cwd, os.platform, os.arch, and process.env.CI and POSTs them as...
Malicious code in @s4yhiitestpoc/r2-https-b (npm)
Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network interface addresses, DNS servers, current working directory,...
CVE-2024-57430
CVE-2024-57430 An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege escalation, or database...
CVE-2026-84167
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...
CVE-2026-107203
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
EUVD-2026-97242
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referenci...
CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...
CVE-2026-21134
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...
CVE-2026-21117
Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...
CVE-2026-107203
The Foreman package contains an incorrect authorization flaw in its network interface handling . The domain and subnet interface API fails to apply search limits on host permissions, allowing a low-privileged network attacker to view interface records for hosts they are not authorized to access. ...
CVE-2026-107203 Foreman: domain and subnet interface api skips host search filters
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
EUVD-2026-97236
An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...
CVE-2026-48813-POC
Flawfinder-ANSI-Exploit-POC In version 2.0.19 of Flawfinder, no filename sanitization occurs when parsing possibly malicious filenames. Known affected terminals are libvte based, and the example below shows a mate-terminal. This exploit has since been fixed in version 2.0.20 as of 5/17/26 by Davi...
EUVD-2026-97199
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...
CVE-2026-21135
The Samsung Internet browser, in versions prior to 30.0.5.6 , is affected by an improper access control vulnerability. This flaw allows local attackers to gain unauthorized access to sensitive information . No specific root cause, exploit details, or remediation instructions are provided in the d...
EUVD-2026-97198
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...
CVE-2026-21134
Versions of Samsung Flow prior to 4.9.22.4 are susceptible to an improper authentication vulnerability. This flaw allows adjacent attackers to gain unauthorized access to sensitive information . No specific exploit details or remediation instructions are provided in the documents.
Vidar-Stealer-Reverse-Engineering
Vidar Stealer 2.0 Reverse Engineering Analysis Overview This analysis covers an in-depth reverse engineering of Vidar Stealer 2.0 , a sophisticated information stealer that uses advanced evasion techniques to remain undetected. Key findings include: Task Scheduler Tampering: Modifies system task...