Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...

MAL-2026-11489 Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...

MAL-2026-11494 Malicious code in test-dev-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b79a278016b87011ec1e810ce455d87ab6346a1045cc007e0155b204c8cc2532 test-dev-sync is a browser data stealer coupled to a remote-command backdoor. grabberuser.js enumerates Chrome/Chromium/Opera/Vivaldi profiles under...

[SECURITY] Fedora 44 Update: python3.12-3.12.13-6.fc44

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

mwr-capstone-pentest-report

No d...

CVE-2026-17346

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

EUVD-2026-51562

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

Agent-Security-Regression-Harness v0.2.0

OWASP Agent Security Regression Harness The OWASP Agent Security Regression Harness is an open source, vendor-neutral test harness for running executable security regression scenarios against agentic applications and MCP-integrated systems. The project helps builders and defenders verify that...

CVE-2026-14919

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

CVE-2026-14919

The ShopMonitor.io WordPress plugin, in versions before 1.2.0 , is vulnerable to an unauthenticated administrator account takeover . The root cause is an improperly restricted email-rerouting test mode that relies on a trusted-source check satisfiable via client-supplied request headers . This fl...

CVE-2026-14919 ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

EUVD-2026-51440

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

PT-2026-66706

Name of the Vulnerable Software and Affected Versions ShopMonitor.io versions prior to 1.2.0 Description The plugin fails to properly restrict its email-rerouting test mode, relying on a trusted-source check that can be bypassed using client-supplied request headers. This allows unauthenticated...

GitLab 18.4 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-4672)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

The vulnerability of the API for reporting testing results of CI/CD pipelines is a problem with the Pipeline Test Report API software platform based on Git. This API allows attackers to compromise the confidentiality of protected information.

The vulnerability of the API reports for testing CI/CD pipelines is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected information...

CVE-2026-61893

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

CVE-2026-61893 MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

CVE-2026-61893 MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...