Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

CVE-2026-76342

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-62710

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

MAL-2026-14302 Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

MAL-2026-14261 Malicious code in postcss-initialize-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16 [email protected] presents itself as a PostCSS plugin README, badges, and repository links reference the legitimate...

Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

MAL-2026-14250 Malicious code in luluking1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET environment variables vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

GHSA-Q4GH-4FFP-5CG8 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640

In MagicMirror² versions before 2.37.0, the catch-all socket dispatcher in js/node_helper.js runs replaceSecretPlaceholder on every inbound payload, letting an attacker submit a SECRET_API_KEY placeholder that expands to the live env value; the weather helper then echoes it back via WEATHER_ERROR...

DEBIAN-CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

CVE-2026-71365

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

DEBIAN-CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

AZL-96885 CVE-2026-63639 affecting package valkey for versions less than 8.0.10-1

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...