PT-2026-82791

Name of the Vulnerable Software and Affected Versions Ebyte gateway products affected versions not specified Description Improper protection of authentication tokens in the web management interface occurs during client-side session handling. This flaw allows an attacker who obtains exposed sessio...

CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

DRUPAL-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server through 0.16.19 fails to validate OAuth redirect_uri against registered destinations in its default configuration. The root cause lies in crates/http/src/auth/oauth/registration.rs, where the validation routine returns success immediately because the client-authentication req...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

EUVD-2026-66610

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034

Netmaker (through v1.6.0 ) unconditionally disables TLS certificate verification on its SMTP connection in pro/email/smtp.go , where the skip-verify field is set to true with no configuration path to override it. An attacker positioned between Netmaker and its mail relay can present a rogue certi...

CVE-2026-81029 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

EUVD-2026-66605

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-81027 one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-81027

one-api (through version 0.6.10 ) contains an authorization bypass in its channel-pinning logic in middleware/auth.go. The software offers two ways to pin a request to a specific upstream channel: a suffix on the API key and a URL path parameter (channelid). Only the suffix path is gated behind a...

Malicious code in commonjs-code-token (npm)

Source: amazon-inspector c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval. Whoever controls that endpoin...

MAL-2026-14534 Malicious code in commonjs-code-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned...

Malicious code in commonjs-code-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned...

Malicious Package

Overview commonjs-code-token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...