41318 matches found
Malicious code in ezymail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea463f516048086ec4acfc2733edc9561dac749d19c2e47381fc170c451cd53c The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP user and pass Gmail App Password to a...
EUVD-2026-31029
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-8610
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-8610 TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-44791
creationtimestamp| type| source ---|---|--- 2026-05-20 00:16:19+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mmamu5rnds2m 2026-06-24 17:03:17+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mp2fh36qon2j...
CVE-2026-44790
creationtimestamp| type| source ---|---|--- 2026-05-20 00:16:19+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mmamu5rnds2m 2026-06-27 10:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpbbbc4iiu2n...
CVE-2026-44789
creationtimestamp| type| source ---|---|--- 2026-05-20 00:16:19+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mmamu5rnds2m 2026-06-24 17:03:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mp2fgmz2rn2o 2026-06-27 10:07:08+00:00| seen|...
Backchaining Loss of Control Mitigations from Mission-Specific Benchmarks in National Security
Affordances and permissions are promising and timely safety levers for mitigating Loss of Control LoC threats in high-stakes deployment contexts, such as national security. Deployers in defense and intelligence could rely on several approaches to identify which affordances and permissions should ...
Rsync 后置链接漏洞
Rsync is a fast and versatile file copying tool developed by RsyncProject. It is used for both remote and local files. Versions of Rsync 3.4.2 and earlier have a post-release vulnerability due to a symbolic link race condition in the path system call. Local attackers can redirect operations to...
PT-2026-42103
Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 4.9.8 Description The All in One SEO plugin for WordPress allows sensitive internal option data to be passed to the wp localize script function in post editor contexts without effective masking for low-privileg...
TeleJSON 跨站脚本漏洞
TeleJSON is an open-source JSON extension library developed by Storybook that supports complex data types. Versions of TeleJSON prior to 6.0.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from a DOM-based cross-site scripting vulnerability within the parse function...
📄 ZTE Unauthenticated Denial of Service
ZTE routers 17+ models suffer from an unauthenticated denial of service vulnerability via an oversized POST body. Title: ZTE Routers 17+ Models - Unauthenticated Denial of Service via Oversized POST Body Date: 2026-05-20 Author: Mina Nageh Salalma Monx Research CVE: CVE-2026-34473 Vendor: ZTE...
PT-2026-42065
Name of the Vulnerable Software and Affected Versions Bottom Bar versions prior to 0.1.8 Description The Bottom Bar plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to do. The issue exists ...
Malicious code in lokal-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04df34ff182a72a46dc032016ed38e0caf7452ac3b8d382bb15221706c01a9e8 index.js contains a hardcoded URL https://rettfrabonden.com referenced alongside process.env reads and fetch POST calls index.js line 24 defines the...
MAL-2026-4602 Malicious code in lokal-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04df34ff182a72a46dc032016ed38e0caf7452ac3b8d382bb15221706c01a9e8 index.js contains a hardcoded URL https://rettfrabonden.com referenced alongside process.env reads and fetch POST calls index.js line 24 defines the...
CVE-2026-32814
creationtimestamp| type| source ---|---|--- 2026-05-19 23:27:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmak4oejsn2i...
CVE-2024-36343
creationtimestamp| type| source ---|---|--- 2026-05-19 23:17:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmajkrhlru2q...
CVE-2026-34579
Mantis Bug Tracker MantisBT is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bugmonitoradd.php, a user with project-level access can add themselves as a monitor for a...