CVE-2026-71464

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

SUSE CVE-2026-92708

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-31377

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

Malicious code in sea-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf4b5ddb859270a86aa6d21df680ed66fb0622434317747a6f7275ad9a3d60 sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the libsignal import specifier to...

CVE-2026-31377 Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

MAL-2026-16440 Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

SUSE CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

PT-2026-97557

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.0 Description An issue exists where the is authorized/2 function uses is authorized monitor for all methods. This allows a user with the monitori...

CVE-2026-66069: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

PT-2026-105057

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...

PT-2026-105248

Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

PT-2026-97518

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...

Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

CVE-2026-92708

A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...

EUVD-2026-84005

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...

EUVD-2026-84032

KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes...

MAL-2026-16403 Malicious code in node-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in node-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview node-env-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...