Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

MAL-2026-15849 Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80757 selinux: reject a class permission count below its inherited common

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80757 selinux: reject a class permission count below its inherited common

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

EUVD-2026-70361

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

PT-2026-84955

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap write exists in the SELinux component. The class read function accepts a permission count nprim from the policy image without verifying if it covers the inherited...

AZL-99273 CVE-2026-78662 affecting package libcontainers-common 20240213-3

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99270 CVE-2026-56855 affecting package libcontainers-common 20240213-3

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

ROOT-APP-NPM-CVE-2022-37603 CVE-2022-37603 in loader-utils - Patched by Root

Root has patched CVE-2022-37603 in the loader-utils package for Root:npm. Multiple fixed versions available...

CVE-2026-5153

creationtimestamp| type| source ---|---|--- 2026-09-02 10:00:30+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-09-01 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7b4ab454-d7da-47b7-8de3-083f9b71d5a8 2026-09-03...

Security Bulletin: Vulnerability in commons-configuration2 impacts IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent is affected by Uncontrolled recursion vulnerability in Apache Commons CVE-2026-45205 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. Wh...

Security Bulletin: Due to use of bootstrap, IBM License Key Server Administration and Reporting Tool is affected by Cross-site scripting

Summary IBM License Key Server Administration and Reporting Tool uses bootstrap javascript library internally. Vulnerability Details CVEID:CVE-2025-1647 DESCRIPTION: Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows...

Security Bulletin: IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent is affected by a vulnerability in httpcore5 jar (CVE-2026-54399)

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent are affected by a vulnerability CVE-2026-54399 reported for httpcore5 jar Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 messa...

firmwalker

firmwalker A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .cr...

PT-2026-85175

These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11674-1 glances-common-4.5.6-1.1 on GA media

These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-52130: Uncontrolled Recursion

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

Improper Certificate Validation

Bouncy Castle for Java is vulnerable to Improper Certificate Validation. The vulnerability is due to improper hostname verification behavior, which allows an attacker to exploit certificate validation by relying on the certificate’s Common Name CN when the hostname does not properly match the...

CVE-2026-82866

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...