com.squareup.wire:wire-compiler (1.3.2), com.squareup.wire:wire-gson-support (1.3.2) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.2)

com.squareup.wire:wire-runtime MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.2 - com.squareup.wire:wire-gson-support 1.3.2 -...

com.squareup.wire:wire-compiler (1.3.1), com.squareup.wire:wire-gson-support (1.3.1) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.1)

com.squareup.wire:wire-runtime MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.1 - com.squareup.wire:wire-gson-support 1.3.1 -...

com.squareup.wire:wire-compiler (1.3.3), com.squareup.wire:wire-gson-support (1.3.3) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.3)

com.squareup.wire:wire-runtime MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.3 - com.squareup.wire:wire-gson-support 1.3.3 -...

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the CORS plugin's handling of the Vary header. An attacker can manipulate cache key behavior and cause inconsistent CORS enforcement by injecting arbitrary values into the response's Vary header through craft...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +94 more potentially affected by CVE-2026-63461 via @vendure/core (>=1.9.5, <=3.4.4)

@vendure/core NPM version =1.9.5, =1.0.0, =1.0.4, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.2.4 and more Source cves: CVE-2026-63461 Source advisory: OSV:GHSA-XF65-R35X-WMMV...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-49476, CVE-2026-49477)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-49476 DESCRIPTION: Soup Sieve is a CSS selector...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...

CVE-2021-43798-Grafana-path-traversal-tester

Grafana Path Traversal Tester This script automates the testing of known Grafana plugin endpoints for potential path traversal vulnerabilities using curl. 🛠 Features Reads target paths from a file e.g. paths.txt Sends HTTP requests using --path-as-is to bypass normalization Captures HTTP status...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

Malicious code in leda-mini-css-extract-plugin-backend-radiant (npm)

Source: amazon-inspector 5c4e8c96252e0a5977fee5bfae6a2fa581b05ed4f4f55675f812153ea1063241 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview latam-xp-analytics-plugin-absmartly is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious code in latam-xp-analytics-plugin-absmartly (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

Malicious code in latam-xp-analytics-plugin-gtm (npm)

Source: ossf-package-analysis 333a48f2dfbcb9ab75608fb120182771732f71543d3bc13c3352b144b3022403 The OpenSSF Package Analysis project identified 'latam-xp-analytics-plugin-gtm' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in lacerta-html-webpack-plugin-socketio-jabbah (npm)

Source: amazon-inspector a63dbc92d7357f2dc4da01f1acf0624b6e8e6e4639bca26a33abcb901e3057f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-optimize-css-assets-webpack-plugin-unuk-prettier (npm)

Source: amazon-inspector e0c13c9ad8a827a0a466f60482bd8a6551b5d9521b8c924baa9dca6a48e9363c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-style-loader-mini-css-extract-plugin-less (npm)

Source: amazon-inspector 222914e44e98bf610164e7ab4d3b3240a1bf355716c59e8661864f5d3de0ffc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-eris-altair-terser-webpack-plugin (npm)

The package lacerta-eris-altair-terser-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kupo-app-secure-store-plugin (npm)

Source: ossf-package-analysis d04ed47c7e296896a93ec11ccbe851b0a3d33f3afe06d2aaba32be6263363a33 The OpenSSF Package Analysis project identified 'kupo-app-secure-store-plugin' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...