Malicious code in troubleshooting (npm)

troubleshooting is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install, and index.js...

PT-2026-107569

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 ImageMagick versions prior to 6.9.13-56 Description A missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that the policy should deny, which can also le...

PT-2026-107409

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

PT-2026-107428

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successf...

UBUNTU-CVE-2026-106446

Handlebars provides the power necessary to let users build semantic te...

PT-2026-107545

Name of the Vulnerable Software and Affected Versions @backstage/plugin-kubernetes-backend versions prior to 0.21.8 Description Improper entity validation in a deprecated Kubernetes services endpoint allows an authenticated user with Kubernetes read permissions to access workload data beyond thei...

The vulnerability of Azure CycleCloud, a tool for organizing and managing high-performance computing environments, related to insufficient protection of registration data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure CycleCloud tool for organizing and managing high-performance computing environments is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of Atlassian Data Center software products lies in the use of files and directories accessible from external parties, which allows attackers to gain unauthorized access to protected information.

The vulnerability of Atlassian Data Center software lies in the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-106332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-106379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-106565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check whil...

Linux Distros Unpatched Vulnerability : CVE-2026-106180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-106184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-106253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome...

Linux Distros Unpatched Vulnerability : CVE-2026-106339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtai...

Linux Distros Unpatched Vulnerability : CVE-2026-106360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

The vulnerability of the Work Folders service in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Work Folders service in Windows operating systems is related to the operation of data out of the buffer into memory. Exploiting this vulnerability can allow an attacker to increase their privileges...