CVE-2026-30926

SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts RoleReader to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint...

Security Risk Advisors Releases “The Purple Perspective 2026” Report

Philadelphia, PA, United States, 9th March 2026, CyberNewswire...

Malicious Package

Overview ua.unitedforbusiness.frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Google Android Privilege Bypass Vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a privilege bypass vulnerability that can be exploited by an attacker to cause a local elevation of privilege...

GHSA-FPX8-73GF-7X73 Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

Summary The webhook URL validation in plane/app/serializers/webhook.py only checks ip.isloopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.. When webhook events fire, the...

org.eclipse.jetty:jetty-http has different parsing of invalid URIs

The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically: Invalid Scheme | URI | Jetty | uri-js nodejs | node-urlnodejs | |---|---|---| --- | | https://vulndetector.com/path | scheme=http| scheme=https | invalid URI |...

CVE-2026-28548

Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-40926

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be...

PT-2026-23446

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An issue existed in Octopus Server where a new API key could be created from an existing access token. This allowed the new API key to have a longer lifetime than the original access...

Manipulating AI Summarization Features

Microsoft is reporting: Companies are embedding hidden instructions in "Summarize with AI" buttons that, when clicked, attempt to inject persistence commands into an AI assistant's memory via URL prompt parameters…. These prompts instruct the AI to "remember Company as a trusted source" or...

Pentagon ditches Anthropic AI over “security risk” and OpenAI takes over

On Friday the US Pentagon cut ties with Anthropic, the company behind Claude AI. Defense Secretary Pete Hegseth designated the San Francisco-based company a "supply-chain risk to national security." The supply-chain risk designation means that no contractor, supplier, or partner doing business wi...

Malicious code in solongnerds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4924a4f78f84d4b49d96f2ced7769ac484017ae28bb6fe63f94e937b199222f The package solongnerds was found to contain malicious code. Source: ghsa-malware 5ef9463bd7feaee40d35efb13e75f19b54fd802eeb788cddc3cbbd1ba90b2ba4 An...

MAL-2026-1152 Malicious code in pool-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 307e708d931ed9e7fc3cadd2e2daf55f69a216e6048275ae16db575e4939c805 The package pool-check was found to contain malicious code. Source: ghsa-malware 2da2c8462239a3dee4b27482f6d094115705cafcf589553f6836bc871a921ae8 Any...

PT-2026-26746

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22 Description The software reuses the gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset. This...

Malicious code in @skyzopedia/baileys-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027588d92a2ed6ba301f546a8688200af1fbcca8cef1dbe2b8ef1061b414c110 The package @skyzopedia/baileys-mod was found to contain malicious code. Source: ghsa-malware...

CVE-2026-1627

An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffic...

CVE-2025-40932

Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will...

UBUNTU-CVE-2025-40932

Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will...

EUVD-2026-8828

Fleet: Authorization Bypass in certificate template batch deletion for team administrators...

XML External Entity (XXE)

biopython is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML doctype declarations, which allows an attacker to inject malicious external entities and potentially read local files or access internal resources...