CVE-2024-50968

CVE-2024-50968 Description A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker...

CVE-2026-999999

X-Trading Portal: Regional Financial Infrastructure v1.4.2 Overview This repository contains the core distribution and deployment configurations for the X-Trading Portal XTP , a containerized solution designed for retail banking and stock trading services. This version v1.4.2 includes the updated...

GHSA-V2F8-6655-7GRJ Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with APIAUTHKEY set F2, unauthenticated file write of .py/.sh/.yaml to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to grant any...

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with APIAUTHKEY set F2, unauthenticated file write of .py/.sh/.yaml to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to grant any...

Vibe-Trading file-read tools expose arbitrary server-readable files

Summary: 2 findings — safeuserpath accepts any path under Path.home or Path.cwd, which inside the shipped root container resolves to /root and /app so all of root's home, including /root/.ssh/idrsa, /root/.aws/credentials, /root/.kube/config, and /app/agent/.env, passes the check F9. readdocument...

GHSA-5RMQ-CHC7-M22F Vibe-Trading file-read tools expose arbitrary server-readable files

Summary: 2 findings — safeuserpath accepts any path under Path.home or Path.cwd, which inside the shipped root container resolves to /root and /app so all of root's home, including /root/.ssh/idrsa, /root/.aws/credentials, /root/.kube/config, and /app/agent/.env, passes the check F9. readdocument...

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

GHSA-JQMF-MX4F-HFR6 Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

CVE-2026-11795

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54...

CVE-2026-11795

The Softtr Informatics Trading Limited Company E-Commerce Pack (affected through 2026-10-02) contains an observable discrepancy vulnerability (CWE-203) that facilitates Account Footprinting . This flaw allows for user enumeration or footprinting within the application. No specific root cause deta...

EUVD-2026-91591

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-11795: Observable Discrepancy

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-104320

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.54 Description An observable discrepancy issue in Softtr Informatics Trading Limited Company E-Commerce Pack enables account footprinting, a technique used to enumerate and identify valid user accounts...

Malicious code in logs_update (crates.io)

logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access. The crate has no build script, so it does not run during cargo...

Malicious Package

Overview gmgn-trading-kit is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the gmgn-trading-k...

Malicious code in gmgn-trading-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...

MAL-2026-16094 Malicious code in gmgn-trading-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...

Meme Coin Factories: Uncovering Large-Scale Manipulations on Pump.Fun

Once complex, creating and deploying a new cryptocurrency has become trivial. Coin launchpads now allow users to generate a new coin with merely a few clicks, at a minimal cost. Launchpad popularity has grown in tandem with the rise of "meme coins," which usually do not offer any novel...

Malicious code in trading-bot-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653d164163afb590064deec1dc6619ed03e51360605a94e6ff789c83f6d9ec6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16003 Malicious code in trading-bot-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653d164163afb590064deec1dc6619ed03e51360605a94e6ff789c83f6d9ec6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...