Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

CVE-2025-70962

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update

Red Hat JBoss Web Server 7.0.1 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CV...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Shadow AI, Rogue Agents, and Data Leaks: A Special Report on Navigating AI Risk

Discover top enterprise AI risks — from shadow AI to rogue agents and data leaks — plus practical CISO strategies in the new Akamai SOTI special report...

EUVD-2026-53378

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71291

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

MAL-2026-12333 Malicious code in @zahlen/checkout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8 The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation \uXXXX to hide imports of...

CVE-2026-71286

The CVE-2026-71286 entry affects ember-dynamic-render-template’s render-template component, where addon/components/render-template.js forwards the templateString directly to Ember/Glimmer’s compileTemplate() without sanitization or validation. This enables client-side template injection, as attac...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

MAL-2026-12310 Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

EUVD-2026-53327

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

EUVD-2026-53321

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload...

EUVD-2026-53313

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

CVE-2026-17578

Kong Event Gateway vulnerable components: versions 1.0.0–1.1.1 and 1.2.0 fail to enforce key rotation before reaching the NIST SP 800-38D usage limit for AES-GCM keys when AWS IAM encryption is enabled. Under sustained high message rates that trigger a reboot without rotation, nonce collisions be...

CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-71212

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase...