CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...

Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

CVE-2026-47664

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser (CVE-2026-10534)

Summary IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser. Vulnerability Details CVEID:CVE-2026-10534 DESCRIPTION: Db2 is vulnerable to buffer overflow in the IXF IMPORT parser. CWE:CWE-121: Stack-based Buffer Overflow CVSS Source: IBM CVSS Base score: 8.4 CVSS...

EUVD-2026-54651

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

CVE-2026-47664

Pathling Server before 2.0.0 allows a caller-supplied exportUrl in the $import-pnp operation to target a remote FHIR Bulk Export endpoint, then downloads files and reclassifies them as trusted local file:// imports, bypassing the allowableSources allowlist and enabling authenticated SSRF, credent...

CVE-2026-47659 Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

MAL-2026-13606 Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

EUVD-2026-54292

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-7405

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391

CVE-2026-49391 affects Frappe framework’s Data Import feature. Before versions 16.19.0 and 15.109.0, imported column headers were not escaped when rendering previews/results, enabling an authenticated user to persist script content that executes when another user views the import interface (Store...

CVE-2026-7405 TIF File Parsing Out-of-Bounds Read in certain Autodesk products

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...