Malicious code in react-dom-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae606be0dbd7c79552511c2553ec9e1d081df1279f0bc85502a6c08c0f17fb Package name typosquats react-dom. On require'react-dom-helpers/client', client.js decodes a base64-obfuscated Slack bot token and channel ID,...

Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

Malicious code in test_payload_folder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf The package exposes a startVoiceJoinerconfig API that accepts a caller-supplied Discord USERTOKEN and optional USERTOKEN2 ostensibly for gateway logi...

MAL-2026-14191 Malicious code in test_payload_folder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf The package exposes a startVoiceJoinerconfig API that accepts a caller-supplied Discord USERTOKEN and optional USERTOKEN2 ostensibly for gateway logi...

PT-2026-78281

Name of the Vulnerable Software and Affected Versions User Verification by PickPlugins WordPress plugin versions prior to 2.0.48 Description The plugin fails to verify if a request to resend a verification email is authorized for the specified user and does not bind the protection token to that...

PT-2026-78535

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

PT-2026-78371

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

PT-2026-78818

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description Improper privilege management in the Agent Run History handler allows users without admin or power roles to execute searches with system-level privileges. This occurs because the handler...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...

PT-2026-78516

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

PT-2026-78534

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/app id/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-63408: Use of GET Request Method With Sensitive Query Strings

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-76351: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76338: Improper Authentication

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

CVE-2026-55088: Exposure of Sensitive Information to an Unauthorized Actor

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-76251: Missing Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

CVE-2026-76389: Server-Side Request Forgery (SSRF)

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

CVE-2026-76340: Missing Authorization

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer REST API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because...

CVE-2026-14287: Improper Neutralization of Input During Web Page Generation

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

PT-2026-78426

Name of the Vulnerable Software and Affected Versions stigmem pip package stigmem-node version 0.9.0a1 Description A timestamp-handling mismatch exists in federation peer-token validation. This issue can cause valid peer tokens to be incorrectly treated as expired, impacting the availability and...