Malicious code in confx1789550882 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64 The package's main file index.js is an IIFE that, when loaded in a browser same-origin context e.g. via unpkg, reads location.href and document.cooki...

WordPress WPForms Lite plugin < 1.10.0.5 - Unauthenticated PayPal Webhook Forgery vulnerability

Unauthenticated PayPal Webhook Forgery vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin Contact Form by WPForms versions 1.10.0.5...

CVE-2026-78427

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

CVE-2026-78427

NeuVector's admission webhook contains a bypass vulnerability where containers whose image path matches one of three hardcoded service mesh sidecar images are silently excluded from policy evaluation. Since the image path is fully controlled by the workload author, any user with permission to dep...

CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

EUVD-2026-81416

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

PT-2026-94203

Name of the Vulnerable Software and Affected Versions NeuVector affected versions not specified Description The admission webhook silently excludes containers from policy evaluation if their image path matches one of three hardcoded service mesh sidecar images. Because the image path is controlle...

CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

CVE-2026-92720

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720

Kubero through 3.1.1 fails to apply authentication guards to its notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials, register malicious webhooks to intercept pipeline events, or delete existing config...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

EUVD-2026-80903

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...

CVE-2026-92602

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-54167

A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...

EUVD-2026-80860

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602

TDuck survey form through version 5.3 is affected by a Server-Side Request Forgery vulnerability in the WebhookConfigController . The root cause is a failure to validate webhook URLs or verify form ownership, allowing authenticated attackers to attach webhooks to other users' forms and exfiltrate...