44934 matches found
Malicious code in nativescript-swisspost-pcc-creative-editor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9c9ef8861d14485e696e98c66d95ee5c2a5a608b213841c9c18b254003ae049 Package masquerades as an internal Swiss Post NativeScript package name nativescript-swisspost-pcc-creative-editor, description literally Security Po...
EUVD-2025-210140
Contributor Cross Site Scripting XSS in Elizaibots = 1.0.2 versions...
CVE-2025-15658 WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability
Administrator Cross Site Scripting XSS in WP Emmet = 0.3.4 versions...
CVE-2025-15658 WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability
Administrator Cross Site Scripting XSS in WP Emmet = 0.3.4 versions...
MAL-2026-5778 Malicious code in hemi-earn-actions (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9c2a72c75e835bc78738de0839bd4727df93d6bcb8aed2215289973996c4f3c On npm install, the package's preinstall script postinstall.js collects host metadata hostname, username, cwd, npm config and iterates process.env,...
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
A single click on a trusted Microsoft link could have let an attacker pull emails, calendar details, and indexed files out of Microsoft 365 Copilot Enterprise Search. Researchers at Varonis Threat Labs chained three bugs into a one-click exfiltration path they call SearchLeak. Because the link...
CVE-2026-5079
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of...
CVE-2026-5079
The CVE-2026-5079 issue affects the Multer library (versions 1.0.0–2.1.1 and 3.0.0-alpha.1). The vulnerability arises from the append-field dependency parsing bracket notation in field names with no limit on nesting depth, which can cause the allocation of deeply nested object structures and cons...
CVE-2026-49062 WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7...
CVE-2026-49062
CVE-2026-49062 concerns the WordPress plugin Faust.js (faustwp)
WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by l3m3s in WordPress Plugin WP Event SOlution versions = 4.1.12...
MAL-2026-5831 Malicious code in unicocheck-ios (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafc91c569cf42c5f1ff68531a8d5238919f595368ffa90b7d4e5bcc74fe9788 package.json declares a preinstall lifecycle script that runs curl against https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f with query...
WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...
mysql: DML unspecified vulnerability (CPU Apr 2026)
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...
CVE-2026-12213
A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler. The manipulation results in improper authorization. The attack may be launche...
CVE-2026-12206
Grit42 Grit (up to 0.11.0) contains a SQL injection in Grit::Assays::DataTableEntity (modules/assays/backend/app/models/grit/assays/data_table_entity.rb). The issue can be exploited remotely; a publicly available exploit exists. The vendor was contacted but did not respond. No remediation or vers...
CVE-2026-12193
A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtlHandler in the library RevoDetector.sys of the component IOCTL Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is...
PT-2026-49240
Contributor Cross Site Scripting XSS in Elizaibots = 1.0.2 versions...