Malicious code in building-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618f06d0398ff90ef90003464e79f23609a160f4d1606f60cf797fb73fa6dcb The package's sole content is index.js, which on load schedules a timer that fetches a hardcoded list of privileged same-origin paths /admin,...

CVE-2026-79667

Ech0 versions 4.3.4 and earlier fail to enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize based only on the user's admin role, omitting scope checks. The backup export ...

Incorrect Authorization

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Incorrect Authorization through the role context evaluation process. An attacker can gain unauthorized administrative privileges on the root domain by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization missing RequireScopes enforcement on privileged routes. An attacker can gain unauthorized access to privileged endpoints and export sensitive backup data by using a deliberately limited admin access token on rout...