13513 matches found
CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...
CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...
Malicious code in lib-frontsga (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...
Malicious code in @activepieces/piece-google-bigquery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3 The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require"childprocess", an OS reconnaissance...
Malicious code in @activepieces/piece-google-forms (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...
CVE-2026-14829
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...
CVE-2026-5336: Exposure of Sensitive Information to an Unauthorized Actor
The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...
PT-2026-68753
Name of the Vulnerable Software and Affected Versions DataPress Dataverse Integration WordPress plugin versions prior to 2.91 Description Insufficient access restrictions in the template rendering feature allow users with Contributor roles to disclose sensitive information. This issue occurs...
NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props
NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...
opentaint analyzer/latest
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...
CVE-2026-70444
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update
Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer...
CVE-2026-9193
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...
CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...
CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...
CVE-2026-9193
The CVE concerns Progress MarkLogic Server’s Hadoop integration. Affected: MarkLogic Server versions prior to 11.3.6 and 12.0.3. Root cause: improper privilege management allows an authenticated user with a low-privileged Hadoop role to escalate privileges and perform privileged operations agains...
CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...
CVE-2026-9193
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer...
