vantage6-node (4.1.0b1), vantage6-server (4.1.0b1) potentially affected by CVE-2026-73652 via vantage6 (4.1.0b1)

vantage6 PYPI version 4.1.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.1.0b1 - vantage6-server 4.1.0b1 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (4.1.2), vantage6-server (4.1.2) potentially affected by CVE-2026-73652 via vantage6 (4.1.2)

vantage6 PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.1.2 - vantage6-server 4.1.2 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (4.1.0), vantage6-server (4.1.0) potentially affected by CVE-2026-73652 via vantage6 (4.1.0)

vantage6 PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.1.0 - vantage6-server 4.1.0 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (4.1.1), vantage6-server (4.1.1) potentially affected by CVE-2026-73652 via vantage6 (4.1.1)

vantage6 PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.1.1 - vantage6-server 4.1.1 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (4.1.3), vantage6-server (4.1.3) potentially affected by CVE-2026-73652 via vantage6 (4.1.3)

vantage6 PYPI version 4.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.1.3 - vantage6-server 4.1.3 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (4.2.0rc1), vantage6-server (4.2.0rc1) potentially affected by CVE-2026-73652 via vantage6 (4.2.0rc1)

vantage6 PYPI version 4.2.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.2.0rc1 - vantage6-server 4.2.0rc1 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

BIT-ELASTICSEARCH-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

MAL-2026-14239 Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

MAL-2026-14238 Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

CVE-2026-76236: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

PT-2026-78423

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description stigmem-node accepts federation peer key material during peer registration without requiring a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer...

CVE-2026-55090: Improper Neutralization of Input During Web Page Generation

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

CVE-2026-55085: Improper Neutralization of Input During Web Page Generation

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-76237: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76244: Cleartext Transmission of Sensitive Information

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

PT-2026-78426

Name of the Vulnerable Software and Affected Versions stigmem pip package stigmem-node version 0.9.0a1 Description A timestamp-handling mismatch exists in federation peer-token validation. This issue can cause valid peer tokens to be incorrectly treated as expired, impacting the availability and...

CVE-2026-76241: Download of Code Without Integrity Check

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76245: Insufficient Verification of Data Authenticity

stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...