14321 matches found
Malicious Package
Overview fflask is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Incorrect Permission Assignment for Critical Resource
Overview garminconnect is a Python 3 API wrapper for Garmin Connect Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to insecure file-system permissions being set on the OAuth token store by the dump function. An attacker can gain...
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...
BIT-DISCOURSE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps
A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con hardware wallet owners out of their recovery phrase. On an infected PC, the request comes from inside the wallet's own desktop software. Sometimes it waits until you plu...
CVE-2026-61736
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORSORIGINS= combined with allowcredentials=True in lightrag/api/lightragserver.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin request...
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy
A flaw was found in undici. When undici's ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier URI, it silently ignores Transport Layer Security TLS options, such as custom Certificate Authorities CAs. This allows a remote attacker to perform a Man-in-the-Middle MITM attack,...
The vulnerability in the `vault/namespace_store.go` file of the OpenBao system for managing secrets and encryption allows a perpetrator to compromise the integrity of the protected information.
The vulnerability in the vault/namespacestore.go file of the OpenBao encryption and secret management system is related to improper inter-bordering of critical data. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
PT-2026-60373
Name of the Vulnerable Software and Affected Versions garminconnect versions prior to 0.3.5 Description The software writes its OAuth token store to disk without restricting file-system permissions. On systems with a default Linux umask of 022, the token file garmin tokens.json is created as...
Authorization Bypass Through User-Controlled Key
Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the appointments/store and appointments/update endpoints. An...
EUVD-2026-43840
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally...
EUVD-2026-43990
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally...
EUVD-2026-43977
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally...
EUVD-2026-43970
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50356
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally...
CVE-2026-49784
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally...
CVE-2026-49165
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally...
CVE-2026-42900
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50356
Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally...
