91634 matches found
Embedded Malicious Code
Overview bmc-i18n-extract-cli is a 这是一款能够自动将代码里的中文转成i18n国际化标记的命令行工具。当然，你也可以用它实现将中文语言包自动翻译成其他语言。适用于vue2、vue3和react Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by...
Embedded Malicious Code
Overview feishu-docx-mcp is a Model Context Protocol server for Feishu integration Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published...
Embedded Malicious Code
Overview bmc-translate-utils is a 翻译工具函数，支持有道，谷歌，百度，阿里机器、openAI翻译 Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple packages maintained by ham1912. A malicious actor published tampered version...
EUVD-2026-72043
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...
CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...
CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...
PT-2026-86472
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate user function's Facebook authenticator resolving third-party identity by forwarding the...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053406)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053406 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is...
CVE-2026-86195
grav-plugin-api versions 1.0.0 through 1.0.19 contain a privilege escalation vulnerability in the InvitationsController . The stripSuperFlags() method removes nested super flags but fails to strip dot-keyed equivalents such as api.super . A non-super user with api.access and api.users.write permi...
EUVD-2026-72010
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...
CVE-2026-86115
Sim (an open-source tool by SimStudio) before 0.8.14 contains a confused deputy flaw in tool URL routing. Requests are classified as internal via URL prefix matching without scheme normalization , causing SSRF validation to be skipped and internal authentication tokens to be minted for user-suppl...
CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...
CVE-2026-77826
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
CVE-2026-77826
The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 (specifically 5.0.1.8 through 6.0.9.8 ), is vulnerable to an unauthenticated authentication bypass . The root cause is a failure to validate the audience of a Facebook access token , meaning the plugin does not verify which appl...
EUVD-2026-71848
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
EUVD-2026-71838
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...