75701 matches found
Malicious Package
Overview test6789.v3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
Malicious Package
Overview OCI.DotNetSDK.Dashboard.service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...
Malicious Package
Overview OCI.DotNetSDK.Usage.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious Package
Overview OCI.DotNetSDK.File.storage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview Stl.Fusion.Ext.Contracts.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview OpenAI-Core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
Malicious Package
Overview OCI.DotNetSDK.Ai.vision is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious Package
Overview Rockstar.AssetManager.Infrastructure is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...
CVE-2026-16244
creationtimestamp| type| source ---|---|--- 2026-07-20 15:55:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3nsjha762i...
CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...
CVE-2026-32822
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...
CVE-2026-32807
CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...
CVE-2026-32807 dataCycle Public DataLink Text File Download Ignores Validity And Authorization
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly...
CVE-2026-12701
creationtimestamp| type| source ---|---|--- 2026-07-20 15:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3marmjpe2v 2026-07-20 16:41:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr3qetak6c2j 2026-07-20 18:05:10+00:00| seen|...
GHSA-6Q95-FCWC-4H44
creationtimestamp| type| source ---|---|--- 2026-07-20 15:00:03+00:00| seen| https://t.me/bdufstecru/3329 2026-07-21 00:00:38+00:00| published-proof-of-concept| https://t.me/bdufstecru/3329...
CVE-2026-63747
creationtimestamp| type| source ---|---|--- 2026-07-20 13:41:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3gbhuj5j2j 2026-07-23 07:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcdde3lvc2m...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
CVE-2026-46495
creationtimestamp| type| source ---|---|--- 2026-07-20 13:07:29+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mr3efcczps2d 2026-09-15 14:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvktlkbktw2t 2026-09-15 16:08:29+00:00| seen|...
CVE-2026-64620
creationtimestamp| type| source ---|---|--- 2026-07-20 12:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3c3dec742e 2026-07-20 13:50:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3gs3ubu52g 2026-07-21 04:02:04+00:00| seen|...