The npm package 'dowload_ebok_the_riviera_set_by_mary_s_lovell_l7i1k' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_energy_balls_by_christal_sczebel_oybjj' contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised machine to prevent further damage.
The npm package 'dowload_ebok_massacre_a_odessa_ko_tome_1_by_alex_de_brienne_1ewma' contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_love_and_trouble_memoirs_of_a_former_wild_girl_by_claire_dederer_4z18t' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The npm package 'dowload_ebok_la_gran_aventura_de_la_pequena_ranita_by_mark_lesky_dlmix' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
A regular expression denial of service (ReDoS) vulnerability exists in rails-html-sanitizer versions 1.0.3 through before 1.7.2. The vulnerability arises from a regexp used to validate href attributes in SVG reference elements, which can cause quadratic-time processing on inputs with long whitespace runs. Only Ruby versions 3.1 and earlier are affected due to their regexp engine behavior. The default configuration is not affected unless SVG reference elements and their href attributes are explicitly allowed. The issue is fixed in version 1.7.2.
An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.
A path traversal vulnerability (CWE-22) exists in tensorchord envd versions from 0.3.38 up to but not including 1.3.6. The issue occurs in the install.python_packages(requirements=...) function, where insufficient containment allows reading files outside the intended build context. An attacker who can influence build inputs may cause unauthorized file contents to appear in debug logs or build metadata, limited by envd process permissions. Exploitation in version 1.3.5 requires concurrent filesystem modifications. The vulnerability is fixed in version 1.3.6.
Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a
forward_header distinct from the token header an unauthenticated
client can supply the value the upstream treats as gateway-decrypted
plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Incorrect Authorization vulnerability in Apache APISIX.
An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.
This issue affects Apache APISIX: from 1.4.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.
Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.
This issue affects Apache APISIX: from 3.8.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthenticated client can reach upstream paths protected
by a route-level auth plugin when a route without auth exists on the
same upstream and the upstream does not collapse encoded dot segments.
This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Authentication bypass by spoofing vulnerability in Apache APISIX.
When a Route's configured headers carry a caller identity and the OpenAPI document declares
the same header, a caller can act as another identity against the
upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
The PyPI package 'testing1345' version 0.1.0 contains malicious code that executes during installation. It downloads and runs a remote script, which may vary between benign and malicious payloads. The final payload is a Remote Access Trojan (RAT), enabling unauthorized control of the infected system.
Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.
With match_uri_encoded_slash enabled and skip_mtls_uri_regex
configured, a client without a certificate can reach an upstream
behind a route that requires one, limited to request paths that decode
to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint can invoke endpoints the OpenAPI document
never declared, under the declared tool's HTTP method, using the credentials the
Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
GLPI versions from 9.5.0 up to but not including 10.0.27, and from 11.0.0 up to but not including 11.0.9, contain an improper access control vulnerability. Authenticated users could access ITIL followups, tasks, or solutions derived from templates without proper read-permission checks on the parent ticket, problem, or change. This could lead to unauthorized disclosure of information from parent items. The issue is fixed in versions 10.0.27 and 11.0.9.
Nuxt versions from 4.6.0 up to but not including 4.6.4 have a URL interpretation conflict where request paths starting with // are parsed differently by Nuxt and Nitro server components. This discrepancy allows unauthenticated requests like //x/admin to bypass route-scoped server handlers, middleware path checks, redirects, and security headers configured for the /admin route. The issue is fixed in version 4.6.4.
CVE-2026-128076 is a low-severity vulnerability in the @nuxt nitro-server framework affecting versions from 3.21.6 up to but not including 4.0.0 and from 4.4.6 up to but not including 4.6.4. It involves improper encoding or escaping of output in the /__nuxt_island path hash, which uses ohash serialization that does not escape quotes in string values or delimiters in object keys. This flaw allows different island-prop tuples to produce the same path, potentially leading to content substitution or script execution if unsafe HTML sinks like v-html or innerHTML are used. The issue is fixed in version 4.6.4.