Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

CVE-2026-15337

A flaw was found in Django. A remote attacker could trigger a denial-of-service DoS condition by sending many distinct, very long language codes to the django.utils.translation.checkforlanguage function. These codes are stored in an in-memory cache, leading to excessive memory consumption. While...

CVE-2026-14643

A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in no-cache or private Cache-Control directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically...

bower-cache (0.5.0), cactus (>=3.1.0, <=3.3.3) +22 more potentially affected by CVE-2026-15830 via django (1.6.11)

django PYPI version 1.6.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - bower-cache 0.5.0 - cactus =3.1.0, =0.3.2, =0.11.0, =0.1.1, =0.1.1, =0.1.0, =0.2.0, =0.2.1, =0.2.3 - django-pesapal 0.2.1 and more Source cves:...

django-autoconfig (>=0.6.0, <=0.7.2), django-cache-manager (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-15307 via django (1.11.0rc1)

django PYPI version 1.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-autoconfig =0.6.0, =0.5.0, =0.5.1 - django-inline-actions 1.1.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

POC-keyv-and-cacheable-npm-Package

ChainDrop npm Supply Chain Attack — PoC Scanner & Exploit...

CVE-2026-13697

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux is affected by CVE-2026-24255 in the multimodal embedding cache. The issue arises when submitting images that share an identical pixel byte sequence but have different dimensions, potentially enabling data tampering via a hash collision. Affected product: NVIDIA Dynamo for...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

EUVD-2026-52803

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

django-autoconfig (>=0.6.0, <=0.7.2), django-cache-manager (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-15830 via django (1.11.0rc1)

django PYPI version 1.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-autoconfig =0.6.0, =0.5.0, =0.5.1 - django-inline-actions 1.1.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

UBUNTU-CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

Important: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...