MAL-2026-11388 Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

CVE-2026-67207

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

EUVD-2026-51293

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-67207 Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-67207 Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-67207

CVE-2026-67207 affects Wolf CMS up to version 0.8.3.1. The vulnerability is an authorization bypass in the BackupRestoreController caused by a PHP operator precedence flaw in the permission check expression. This allows authenticated non-administrative users to access restricted backup functional...

CVE-2026-67207 Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview...

SUSE CVE-2026-34940

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript function in internal/modelcontroller/engineollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components ref, modelParam. This shell command is executed via bash ...

SUSE CVE-2026-34984

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

SUSE CVE-2026-35596

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, description...

SUSE CVE-2026-39961

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace - production database credentials, API keys...

SUSE CVE-2026-42221

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable...

SUSE CVE-2026-42461

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full...

SUSE CVE-2026-42792

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The doaccept function in erts/epmd/src/epmdsrv.c calls epmdcleanupexit when accep...

SUSE CVE-2026-42875

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...

SUSE CVE-2026-42876

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...

SUSE CVE-2026-44349

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...

Read This Before You Buy That TV Streaming Stick

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices als...