EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

EUVD-2026-87839

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100859: Server-Side Request Forgery (SSRF)

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100849: Server-Side Request Forgery (SSRF)

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

BIT-GITLAB-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

PT-2026-97126

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection exists in the file /reviewer 0/admins/assessments/pretest/exam-delete.php. This issue occurs when the test id argument is manipulated, allowing an...

PT-2026-97125

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the test id argument within an unknown function in the '/reviewer 0/admins/assessments/pretest/btn...

Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16374 Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16375 Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16376 Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-55563

Feast , an open-source feature store for AI/ML, is vulnerable in versions prior to 0.65.0 through its GitHub Actions workflow (.github/workflows/pr_integration_tests.yml). The workflow uses pull_request_target with the synchronize event and preserves approval labels (ok-to-test, approved, lgtm) a...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...