50952 matches found
NPM: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
NPM: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host vulnerability discovered by ? in WordPress Npm n8n versions 1.123.55...
Malicious code in backoffice-charges-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who ow...
GHSA-QXVM-PCFM-QC39 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who ow...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via insufficient sanitization of input passed to the aria2c external...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...
CVE-2026-54276 vulnerabilities
Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...
CVE-2026-54280 vulnerabilities
Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...
CVE-2026-54278 vulnerabilities
Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...
opencode-apk-forge
APKForge - The Dark Version of OpenCode ███╗ ███╗ ██╗...
Authentication Bypass
@nestjs/platform-fastify is vulnerable to Authentication Bypass. The vulnerability is due to improper route matching between Fastify and NestJS middleware registered through MiddlewareConsumer.forRoutes, which allows an attacker to bypass authentication middleware by appending a trailing slash / ...
CVE-2026-53776
creationtimestamp| type| source ---|---|--- 2026-06-16 17:21:17+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mogcpum37t2k 2026-06-16 17:58:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogert55pv2f 2026-06-16 18:00:45+00:00| seen|...
CVE-2026-12008 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-GPGJ-GWJP-8VM9 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-12034 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-5X54-5CG6-5439 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-276G-W4M7-HP25 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-PR7P-M797-X6PJ vulnerabilities
Vulnerabilities for packages: chromium...