CVE-2026-82270

Portkey AI Gateway through version 1.15.2 contains a Server-Side Request Forgery (SSRF) vulnerability in the /v1/proxy/* route. The root cause is the absence of the requestValidator middleware on that endpoint. An unauthenticated attacker can set the x-portkey-custom-host header to an internal ad...

CVE-2026-82270 Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

EUVD-2026-67801

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269

Gophish through 0.12.1 has a flaw in its API authentication middleware that fails to enforce account lockout and forced password change policies when a user authenticates with a valid API key. An attacker who already holds a valid API key can retain full API access even after the associated accou...

CVE-2026-81020

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce...

[SECURITY] Fedora 44 Update: python-pynitrokey-0.12.3-4.fc44

A command line interface for the Nitrokey FIDO2, Nitrokey Start, Nitrokey 3 and NetHSM. Includes commands for managing enrolled keys, opening encrypted storage, and generating OTPs...

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities KEV catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in...

CVE-2026-75486

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

Malicious code in 3layerdipstacko8li9w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9886025a6437b781a80821d6f113c08dea138ee45899438c19bf9e7cf3e366c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14608 Malicious code in 3layerdipstack1ykdgn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabe62f28af88a694847d251ec0545bcdfe498e5bf37df3e5d32552bfd10aae3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacko89fkl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dd3e617994aeeb1caf198bf507291025fb64a8806480fd15933167e7c70eeb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14954 Malicious code in 3layerdipstackuyd45d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b49a0c197bc8d1d72c142586ce6a7b4c6a6694574fb33ced9f7a770f046bae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14886 Malicious code in 3layerdipstackq6h8eq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b74fd9939571071318b4dd6579bab5337507cfd605a7728ae0c538d51a40abb5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackl3yyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf6f643303604a4cf3e847458b451c2c52af05d2fb0a7fd911661dbaef8c1ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackoo3m1u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9409725a0c60e28d487058cfed06d57101ed7eb4fdf031e19ad43e72f2597d3c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackpsq4vf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88e2901e885945196c6056ba3e4fb253b0972d43153dd4c20116bebad00d986 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14750 Malicious code in 3layerdipstackfhcuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2c32ae7004e4d7416b9ca189f19a048460a89d0b186e77b7050fa4a096c7632 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...