WS-2026-0081

OpenBao before 2.6.3 / 2.7.0 contains an open redirect in the web UI OIDC provider route ui/app/routes/vault/cluster/oidc-provider.js: when an unauthenticated visitor requested the authorize route with prompt=none, the UI redirected to the supplied redirecturi without validating it. An attacker...

CVE-2026-59160

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

Malicious code in am-ui-app-dashboards-mc (npm)

--- Credit: OpenSSF source...

Malicious code in electrode-ota-ui-app (npm)

Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both main: index.js and...

MAL-2026-12368 Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...

CVE-2026-53473

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser...

CVE-2026-53473: Improper Neutralization of Input During Web Page Generation

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +7026 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.17)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-22741 Source advisory: MEND:CVE-2026-22741...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +3085 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-core MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.1.21 and more Source cves: CVE-2026-22746 Source advisory: GHSA-VXF7-QJ7Q-83FH...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +4171 more potentially affected by CVE-2026-22751 via org.springframework.security:spring-security-core (>=6.4.0, <=6.5.9)

org.springframework.security:spring-security-core MAVEN version =6.4.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.5.8, =0.0.1, =55.v51410e712e0c, =0.1.0, =0.1.0, =0.1.0, =1.5.4.release, =1.5.8.release and more Source cves: CVE-2026-22751 Source advisory:...

CVE-2026-5254

A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component Webhook Handler. The manipulation leads to cross site scripting. The attack may be initiated...

CVE-2016-20036

Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like...

CVE-2016-20036

Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like...

MAL-2024-1749 Malicious code in am-ui-app-dashboards-mc (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in am-ui-app-dashboards-mc (npm)

--- -= Per source details. Do not edit below this line.=-...

Malware in @platform-apps/platform-ui-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cloudlinux-ui-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in cloudlinux-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 509013c1d0043e9aca6d292f48a3f9bd4626cfd18271235b6986289ef18f2285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...