Malicious code in chai-chain-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in chai-as-test (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7240 Malicious code in chai-as-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in southwark-test-f8e1778549558 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8848 Malicious code in southwark-test-f8e1778549558 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in southnews-test-35329 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8836 Malicious code in southnews-test-35329 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in civic-test-scrape-out (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7601 Malicious code in civic-test-scrape-out (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in civic-test-scrape (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7600 Malicious code in civic-test-scrape (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1168 Apache Superset has improper default REST API permission for Gamma users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introducedchanges which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed...

Cross-site Scripting in kiwitcms

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack clickjacking and an HTML injection which disables the use of the history page...

PYSEC-2026-837 Cross-site Scripting in kiwitcms

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack clickjacking and an HTML injection which disables the use of the history page...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

python3.14-pip security update

25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...

Cross-site Scripting (XSS)

Overview kiwitcms is a Test Case Management System Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extralink field in TestPlan and TestCase components. An attacker can inject and execute arbitrary JavaScript code by submitting specially crafted input to these...

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...