CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

EUVD-2026-53317

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx: The MailAccountViewSet.test() action can reuse stored credentials (IMAP password/OAuth token) from an existing account when a caller with object-level change_mailaccount permission redirects the test connection to an attacker-controlled IMAP host, causing exposure of real credentia...

Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...

MAL-2026-12281 Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...

Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...

MAL-2026-12282 Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...

Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12185 Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVE-2026-15057)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack...

Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

MAL-2026-12071 Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

[SECURITY] Fedora 44 Update: perl-Devel-Cover-1.52-4.fc44

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

Malicious code in streak-test-mathcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1 Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via childprocess.spawn on any import of the package. The bundled ELF...

CVE-2026-17583: Missing Support for Integrity Check

The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes...