MAL-2026-10819 Malicious code in @gocortexio/npmgremlinbox-epl-2-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 728df3c304b887b63c9511d43eddca5090e5c35bc4abdf77826acbe9325c5b31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @gocortexio/npmgremlinbox-cc-by-nd-3-0-de is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @gocortexio/npmgremlinbox-agpl-1-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-45799

The CVE-2026-45799 issue affects com.squareup.wire:wire-runtime (and related artifacts) where ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() fail to reject negative LENGTH_DELIMITED lengths before skip(). A crafted protobuf varint of -128 can drive the internal position negative, ...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

CVE-2026-47703: Use of Insufficiently Random Values

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dnsid=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response...

AZL-92355 CVE-2026-57221 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...

AZL-92346 CVE-2026-57218 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

CVE-2026-57216: Improper Authentication

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend...

CVE-2026-57218: Incorrect Authorization

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

PT-2026-57303

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.6 Description RabbitMQ AMQP 0-9-1 allows an existing consumer to continue receiving messages even after an OAuth token expires or a connection.update secret refresh reduces the available scopes. This occurs becau...

CLEANSTART-2026-IR97835 Security fixes for CVE-2026-42504 applied in versions: 7.0.34-r2

Security vulnerability affects the mongodb package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-59751

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: python import tensorflow as tf import numpy as np tf.raw ops.FractionalMaxPool value=tf.constantvalue=1, 4, 2, 3, dtype=tf.int64, pooling ratio=1.0, 1.44, 1.73, 1.0, pseudo random=False,...

PT-2026-59857

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0: python import tensorflow as tf @tf.function def test: y=tf.raw ops.AvgPoolGrad orig input shape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0,...

CVE-2026-57019: Improper Validation of Specified Quantity in Input

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. When a specific packet is received from device in the same broadcast...

NPM: Waku: Cross-Origin CSRF on RSC Server Action Dispatch

NPM: Waku: Cross-Origin CSRF on RSC Server Action Dispatch vulnerability discovered by ? in WordPress Npm waku versions = 1.0.0-beta.0...

CVE-2026-10698

CVE-2026-10698 is an Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer, specifically affecting the Custom Reports module . Affected versions are MOVEit Transfer 2025.0.0–before 2025.0.8, 2025.1.0–before 2025.1.4, and 2026.0.0–before 2026.0.1...

PYSEC-2026-996 TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`

Impact When tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status. cpp Status SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...