Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-110776 MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1 . The root cause is insufficient input sanitization and output escaping of the 'vars' parameter . An unauthenticated attacker can inject arbitra...

EUVD-2026-118172

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-111195

TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret "coordinator-secret" baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the...

PYSEC-2026-4049 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

PT-2026-105806

Summary The dashboard reads its authentication credentials from $ESPHOME USERNAME and $ESPHOME PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator w...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from "$ESPHOMEUSERNAME" and "$ESPHOMEPASSWORD". Earlier versions, and the legacy "esphome" dashboard, read the bare "$USERNAME" and...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

CVE-2026-59178: Missing Authentication for Critical Function

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

Malicious code in actions-set-env-vars (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

Malware in postcss-animate-css-vars

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview postcss-animate-css-vars is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

PT-2026-69474

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint...