202256 matches found
dependo
dependo A proof of concept for state-of-the-art observability...
Malicious code in simple-probe-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...
MAL-2026-11147 Malicious code in simple-probe-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...
Malicious code in bianira-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...
MAL-2026-11132 Malicious code in bianira-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacke...
Shared Claude chats were searchable on Google
Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared. This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says...
CVE-2026-15444
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
The Iranian state-backed hacking group tracked as Nimbus Manticore aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549 has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a...
EUVD-2026-49762
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
CVE-2026-15444
The CVE affects the Tutor LMS WordPress plugin up to version 4.0.1. It is vulnerable to a generic SQL Injection in the coupon_code parameter due to insufficient escaping and an inadequately prepared SQL query. Exploitation requires authenticated access at administrator level or higher, enabling a...
CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
CVE-2026-15444
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
Vatican’s Click To Pray app exposed personal data from 700,000 users
A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year. The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer...
WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure
The 3D FlipBook WordPress plugin ≤ v1.16.17 has a vulnerability where an unauthenticated AJAX action fb3dsendposts exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization. id: CVE-2025-5822...
CVE-2026-14785
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-10207
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...
CVE-2026-58222
Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes. An ordinary authenticated domain user can bypass access checks and query confidential Active Directory attributes such as KDS root keys via LDAP Compare requests. Due to a filter injection flaw and...
UBUNTU-CVE-2026-58222
Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes. An ordinary authenticated domain user can bypass access checks and query confidential Active Directory attributes such as KDS root keys via LDAP Compare requests. Due to a filter injection flaw and...