Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

EUVD-2026-42336

Mistune renderers/html.safeurl: HARMFULPROTOCOLS list misses legacy and chained schemes that historically chain to javascript: execution...

CVE-2026-12900 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-34239

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-34239 Chamilo Authenticated Remote Code Execution

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-50743

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

CVE-2026-50743

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

EUVD-2026-46027

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

CVE-2026-51027

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

Improper Isolation or Compartmentalization

Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through...

busybox: BusyBox: Denial of Service via crafted AWK script

A flaw was found in BusyBox. This vulnerability, a stack overflow in the evaluate function, allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted AWK script. A Denial of Service attack can make the affected system or application unavailable to legitimate users...

CVE-2026-53405

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

EUVD-2026-45956

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

CVE-2026-45270 CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

PT-2026-61617

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

MAL-2026-11043 Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

Malicious code in akrai-report-new (npm)

The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

PT-2026-61603

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description An improper isolation issue allows an administrator with sufficient entitlements to impor...