pip3line

Pip3line Codacy Badge Linux / MacOS Builds Windows Builds Raw bytes manipulation utility, able to apply well known and less well known transformations, quick binary search, network proxy interception and more. Install on Windows: Download the release zip here Remember to install/repair the VS...

NodeGoat

NodeGoat Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them. Getti...

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...

GHSA-CVP8-VVGF-69Q4 obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...

CVE-2026-112188: Exposure of Sensitive Information to an Unauthorized Actor

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

CVE-2026-109320

The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...

CVE-2026-109317

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...

EUVD-2026-97622

The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...

EUVD-2026-97619

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

CVE-2026-109317: Improper Privilege Management

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87722 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87722 Source advisory: MEND:CVE-2026-87722...

com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87721 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87721 Source advisory: MEND:CVE-2026-87721...

com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87720 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87720 Source advisory: MEND:CVE-2026-87720...

CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-86729: Improper Restriction of Excessive Authentication Attempts

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...