EUVD-2026-84559

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

Malicious code in @mr-supun-fernando/supunmd-bail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

ROOT-APP-NPM-AIKIDO-2026-10843 AIKIDO-2026-10843 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10843 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10841 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10840 AIKIDO-2026-10840 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10840 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10689 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10724 AIKIDO-2026-10724 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10724 in the vm2 package for Root:npm. Multiple fixed versions available...

PT-2026-97030

An integer overflow vulnerability exists in MPack 1.1.1 in mpack node cstr alloc and mpack node utf8 cstr alloc...

SUSE CVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems such as macOS APFS, In which it has...

Malicious Package

Overview epic-admin-node-services is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-77518

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

CVE-2026-77518 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

CVE-2026-77520 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

CVE-2026-77520

MaxKB (open-source enterprise AI assistant) in versions 2.10.2-lts and earlier has an authorization flaw in the homepage application question-ranking endpoint. A normal user in the same workspace can extract another user's application_id when the victim's published application has ranking activit...

CVE-2026-62182

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

CVE-2026-62182

The KubeEdge system is vulnerable to command injection in the ConfigUpdateJob processing logic located in edge/pkg/taskmanager/actions/configupdatejob.go. The root cause is the concatenation of authenticated user-controlled updateFields values into a command string, which is then executed via a s...

K000163357: Node.js vulnerabilities CVE-2026-23745, CVE-2026-23950, CVE-2026-29786, and CVE-2026-31802

Security Advisory Description CVE-2026-23745 node-tar is a Tar for Node.js. The node-tar library = 7.5.2 fails to sanitize the linkpath of Link hardlink and SymbolicLink entries when preservePaths is false the default secure behavior. This allows malicious archives to bypass the extraction root...

efivar: efivar: Denial of Service due to stack overflow in device path node parsing

A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI Extensible Firmware Interface device path node header. A local user could exploit this...

PT-2026-96254

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description A normal workspace user can retrieve hidden tools by knowing another user's active tool id within the same workspace. This occurs because the tool-detail route does not implement the per-resource...