CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-71832

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrenthelper.cc, which allows a remote malicious user to cause a Denial of Service...

CVE-2026-71510

Dolibarr versions prior to 24.0.0 are affected by a SQL injection in the users REST API. The root cause is that unsanitized filter parameters are spliced directly into SQL WHERE clauses without column restrictions, enabling authenticated users with user-read rights to extract sensitive data not e...

CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

Symlink Attack

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...

CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-71933

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

CVE-2026-71914

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-74694

A flaw was found in the Linux kernel's NCSI Network Controller Sideband Interface component. A local attacker with CAPNETADMIN capabilities could exploit a heap out-of-bounds OOB read vulnerability. By crafting a malicious NCSI command with an oversized payload length, the attacker could cause th...

CVE-2026-71936

Multiple DrayTek VigorSwitch models contain a buffer overflow in the sysreboot function, caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker with valid administrative credentials on the device's web management interface can trigger the flaw via crafted ...

EUVD-2026-64992

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

Malicious code in @medisend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the...

Malicious code in dim-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...

Malicious code in hydration-dim-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...

CVE-2026-18349 SAMA5D44 Fault Injection Vulnerability

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4...

Malicious code in dims-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a85d660f6cc363a81624c7383318958bb46f2d6958fdad71e595692420d805d On any import 'dims-hydration-ui', index.mjs chmods 0755 and spawns a bundled Linux x8664 ELF at dist/internal/calc.dat as a detached child, describe...