CVE-2026-27575

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords e.g., 1234, password without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the authentication and session management process. An attacker can gain unauthorized access to user accounts and maintain persistent access even after a password change by exploiting weak password...

CVE-2026-25736

Affected software : Rucio WebUI. Vulnerability : Stored Cross-Site Scripting (XSS) in the Custom RSE Attribute where attacker-controlled input is persisted and later rendered without proper output encoding. This enables arbitrary JavaScript execution within the WebUI context for viewers of affect...

CVE-2026-25733 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting XSS vulnerability in the Custom Rules function of the WebUI where...

GHSA-H9FP-P2P9-873Q Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary A stored Cross-site Scripting XSS vulnerability was identified in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebU...

Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Summary A stored Cross-site Scripting XSS vulnerability was identified in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of...

Malicious code in chai-as-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11787dc50e16838c5d9f467010f0aaef81b3e55e916c4dd5d3fc811375994e6c The package chai-as-utils was found to contain malicious code. Source: ghsa-malware eb4208b63fd6e66931d39f1a2cd30193e87a717ce9c3ab68e5fce787d0ffdc78...

openSUSE 16 Security Update : mosquitto (openSUSE-SU-2026:20260-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20260-1 advisory. Changes in mosquitto: - update to 2.0.23 boo1258671 Fix handling of disconnected sessions for perlistenersettings true Check return values of...

PT-2026-22031

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.0.0 Description The application allows users to set weak passwords without enforcing minimum strength requirements. Active sessions remain valid after a user changes their password, potentially allowing an attacker...

📄 MS‑EVEN TOCTOU ElfrBackupELFW Arbitrary File Write

This module exploits a Time-of-Check Time-of-Use TOCTOU vulnerability in the MS-EVEN protocol Windows Event Log service. A low-privileged authenticated user can write arbitrary files to a remote Windows machine by abusing the ElfrBackupELFW RPC function. This module strictly follows the MS-EVEN...

Fickling: OBJ opcode call invisibility bypasses all safety checks

Assessment The interpreter so it behaves closer to CPython when dealing with OBJ, NEWOBJ, and NEWOBJEX opcodes https://github.com/trailofbits/fickling/commit/ff423dade2bb1f72b2b48586c022fac40cbd9a4a. Original report Summary All 5 of fickling's safety interfaces -- islikelysafe, checksafety, CLI...

Malicious code in @atg-aml-shared/kyc-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669af5ff086209bd01c2d69a805bb4272ccedbc54a1a1c0ce79b0794dc92daea The package @atg-aml-shared/kyc-domain was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ai-studio-web/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a29e5e23697b695bdd456d100ba49a1ef5c6f4450b46672dedcd164a073e8eb The package @ai-studio-web/app was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1017 Malicious code in json-mapping-srcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4791659c68903f36ecfbf9da2e8af6dacdb98a4a525d5f104d43b07260cca The package json-mapping-srcs was found to contain malicious code. Source: ghsa-malware...

Malicious code in es1int-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09abead9af9906c0579f5cce39e4e75fd445a6edaa1a5380db01ad7dd1e274f8 The package es1int-config was found to contain malicious code. Source: ghsa-malware 3eb94b9e72fc93f339c87b961f88c598fb78ecd2d5e4aad405d17c7eb3d513b2...

OPENSUSE-SU-2026:20260-1 Security update for mosquitto

This update for mosquitto fixes the following issues: Changes in mosquitto: - update to 2.0.23 boo1258671 Fix handling of disconnected sessions for perlistenersettings true Check return values of openssl getexdata and setexdata to prevent possible crash. This could occur only in extremely unlikel...

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated,...

Malicious code in npm-security-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf7ca4cfc33128c3d392d0df3b413365624b0e28a8215a7f0226ca4ec459730 The package npm-security-testing was found to contain malicious code. Source: ghsa-malware...

Malicious code in rbxm-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cc90689ea111d792b6dc071f39e060c440f492130ef599233cf0c4526f55e4 The package rbxm-tools was found to contain malicious code. Source: ghsa-malware 8b70ded43c5def740a34e33c94903aa957ced0450fffd844a1e0f0d4122aea94 Any...

CVE-2026-27189

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state...