CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx: Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx: The MailAccountViewSet.test() action can reuse stored credentials (IMAP password/OAuth token) from an existing account when a caller with object-level change_mailaccount permission redirects the test connection to an attacker-controlled IMAP host, causing exposure of real credentia...

CVE-2026-71244 Paperless-ngx: Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

EUVD-2026-53317

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...

BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

Unauthenticated Server-Side Request Forgery SSRF vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server DWS. The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service...

Malicious code in @nebula.js/test-utils (npm)

npm/@nebula.js/test-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11585 Malicious code in @nebula.js/test-utils (npm)

npm/@nebula.js/test-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in pob-test-typescript-package-in-monorepo (npm)

npm/pob-test-typescript-package-in-monorepo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

CVE-2026-69244 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, kserve, text-generation-inference, puppygraph-python, airflow-core, apache-beam-python-3.13-sdk, dask-kubernetes, py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.12-sdk, kserve-models-web-app...

GHSA-MFX4-HV73-Q22V vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, kserve, text-generation-inference, puppygraph-python, airflow-core, apache-beam-python-3.13-sdk, dask-kubernetes, py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.12-sdk, kserve-models-web-app...

CVE-2026-69243 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, kserve, text-generation-inference, puppygraph-python, airflow-core, apache-beam-python-3.13-sdk, dask-kubernetes, py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.12-sdk, kserve-models-web-app...

GHSA-CQ5V-8Q36-5273 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, kserve, text-generation-inference, puppygraph-python, airflow-core, apache-beam-python-3.13-sdk, dask-kubernetes, py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.12-sdk, kserve-models-web-app...

MAL-2026-12024 Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

MAL-2026-11514 Malicious code in lifestyle-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 804725b6316960d5192b9b46ab823b4bd67f5b15774d1acf1a770a57cfbae84b On require of lifestyle-test-utils, index.js loads ext.js which selects a platform-specific asset, downloads a binary from one of three Cloudflare...

Malicious code in lifestyle-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 804725b6316960d5192b9b46ab823b4bd67f5b15774d1acf1a770a57cfbae84b On require of lifestyle-test-utils, index.js loads ext.js which selects a platform-specific asset, downloads a binary from one of three Cloudflare...

Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...