GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
The npm package @serasa/core version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package can lead to full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a separate, secure device. Simply removing the package may not fully eliminate the malicious presence due to potential persistence mechanisms.
The npm package @settle-sea/supporting-documents version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package can lead to a full compromise of the affected system. Secrets and keys stored on compromised systems should be rotated immediately from a secure environment. Removing the package alone may not fully remediate the compromise due to potential persistent malicious software.
The npm package @shoobx/types version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installation or use of this package can lead to full compromise of the affected system. Removal of the package alone may not eliminate all malicious components, and any secrets or keys on the system should be rotated immediately from a separate, secure device.
The npm package @source-row/source-container version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package may fully compromise the affected computer. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not eliminate all malicious software introduced by it.
The npm package @ataslkit/profilecard version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package can lead to a full compromise of the affected computer. Removal of the package alone may not eliminate all malicious software introduced. Immediate rotation of all secrets and keys stored on the compromised system is strongly advised.
The npm package react-resource-router-next version 99.9.2 contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package can lead to full compromise of the affected system. Removal of the package alone may not eliminate all malicious components, and any secrets or keys stored on the compromised system should be rotated immediately from a secure environment.
The npm package ing-web-v5 version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package can lead to a full compromise of the affected computer. Removal of the package alone may not eliminate all malicious software introduced. Immediate rotation of all secrets and keys stored on the compromised system from a different, secure computer is strongly advised.
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.tencent-cloud-cls log export uses plaintext HTTP
This issue affects Apache APISIX: from 2.99.0 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
The npm package @telekom-wfa/auth-core versions 99.9.11 and 99.9.12 contain malicious code. This malware includes hardcoded Telegram credentials, data exfiltration capabilities, and executes a preinstall script, indicating intentional malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
The npm package @abi-labs-frontend/standards version 9.99.15 was found to contain malicious code. This indicates that the package itself has been compromised or intentionally designed to include harmful functionality. No CVSS score or detailed technical impact information is provided. There is no indication of known exploits in the wild or a vendor patch available at this time.
The npm package @anchor-ds/core version 99.9.0 was found to contain malicious code. This indicates that the package itself has been compromised or intentionally included harmful functionality. There is no CVSS score or detailed technical analysis available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The doctolib RubyGems package versions 99.0.0 through 99.0.4 contain malicious code. This is identified as a malicious package threat rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported.
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL (LinkRepository::create() calls HtmlMeta::getFromUrl()). The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-side requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints. The project already has a NoPrivateIpRule class (app/Rules/NoPrivateIpRule.php) but it is only applied in FetchController.php (line 99), not in the primary link creation path.
The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX action in all versions up to, and including, 2.6.99. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve donation campaign data including campaign IDs and names.
CVE-2026-24007 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Enalean's Tuleap software versions prior to 17.0.99.1768924735. The flaw exists in the 'Overview inconsistent items' functionality, where missing CSRF protections allow attackers to trick authenticated users into performing unintended actions, specifically repairing inconsistent items by creating artifact links from releases. Exploitation requires the victim to be authenticated and interact with a maliciously crafted request. The vulnerability impacts the integrity and availability of the affected system but does not compromise confidentiality. Fixed versions have been released in both the Community and Enterprise Editions. European organizations using vulnerable Tuleap versions for software development management should prioritize patching to prevent potential misuse. No known exploits are reported in the wild as of now.
Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.