CVE-2026-31278: Cleartext Transmission of Sensitive Information

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request...

CVE-2026-79700: Reliance on Untrusted Inputs in a Security Decision

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optinform addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon...

ROS-20260914-73-0128

The vulnerability of the Media component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-90599

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599

A cross-site request forgery flaw exists in Rizwan17 inventory-management-system (GitHub project) in an unknown function of the file includes/process.php . The vulnerability is remotely exploitable with low complexity, requiring user interaction and no prior authentication, yielding a CVSS 3.1 ba...

CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90583

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

Malicious code in ignite-request-bulma-thuban (npm)

Source: amazon-inspector 463b70ae50836606d8f7111e2255bee627a2deb42fe5e78ce2b7ab7e3885285c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90583

A cross-site scripting (XSS) flaw exists in kagisearch smallweb (up to commit 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf) in the index function of app/sw.py within the Query String Rendering component. Manipulating the qs argument injects untrusted content into the rendered page. Exploitation requi...

CVE-2026-90580

FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...

CVE-2026-90580

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

CVE-2026-89080

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

Malicious code in hyperion-link-request-meissa (npm)

Source: amazon-inspector 6316cef7ddbf73e3598d8729cf25cab4c23a141d69ad28be87212ea0eac28d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hyperion-auth-concurrently-request (npm)

Source: amazon-inspector 179c736d71883c669246ba5f27f7dbe695f4468b7bb6a97a7b35364a8a01c626 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hermes-request-antares-less-loader (npm)

Source: amazon-inspector e0e5735598cc672f8656c24783449a33a750bb3c27163408675778eaa624319e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hermes-css-loader-request-restart (npm)

Source: amazon-inspector adebda2e2ae5a06e49e1e41ee6fedb093a0ef37a243ddb9e28e4847013c248e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hermes-css-minimizer-webpack-plugin-local-request (npm)

Source: amazon-inspector 9e2c81158c907717901718ca894e86e52cd0ff7bb06409578ce68b8cd5a40ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...