EUVD-2026-71599

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access...

undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...

CVE-2026-80817

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer deref in iommufdioaschangeprocess when racing with ioptmapfilepages iommufdioaschangeprocess iterates every IOAS area while only holding every IOAS iovarwsem, so it assumes every area has a non-NUL...

CVE-2026-85581

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust proces...

CVE-2026-85581 SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration

SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust proces...

CVE-2026-85581

SiYuan versions prior to v3.8.2 are affected by a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint. The endpoint accepts and retains attacker-controlled process identifiers without size limits or authentication, allowing an attacker to send repeated requests with...

CVE-2026-85534 Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

CVE-2026-85534

A flaw in libsoup 's HTTP/2 client can crash the process when a malicious server manipulates flow-control settings. When a client sends a request body from a non-pollable input stream , the library may buffer more data than the current flow-control window allows. A remote HTTP/2 server can then s...

Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

MAL-2026-15914 Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

MAL-2026-15913 Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-15903 Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

sonar v0.4.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

EUVD-2026-70785

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-75429: Improper Authentication

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-81665: Heap-based Buffer Overflow

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

PT-2026-85806

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During ...