GHSA-2JCC-MXV7-P3F9 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

Summary From v1.13.2 through v1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the rev:path form, e.g. main:openapi.yaml. External $refs were resolved on that load path even when external ref...

PT-2026-56295

Name of the Vulnerable Software and Affected Versions oasdiff versions 1.13.2 through 1.18.0 Description When loading a specification from a git revision using the rev:path format, the software fails to enforce the --allow-external-refs=false setting specifically the...

Amazon Linux 2 : soci-snapshotter, --advisory ALAS2DOCKER-2026-123 (ALASDOCKER-2026-123)

The version of soci-snapshotter installed on the remote host is prior to 0.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-123 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C...

Astra Linux – Vulnerability in Firefox

When opening a website using the firefox:// protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox versions 123...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

The incorrect object was checked as NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue only affects the application when the profiler is running. This vulnerability affects Firefox versions earlier than 123...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 122. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects versions of Firefox prior to 123...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 123. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions prior to 124...

CVE-2026-4897 affecting package polkit for versions less than 123-4

CVE-2026-4897 affecting package polkit for versions less than 123-4. A patched version of the package is available...

MAL-2026-2809 Malicious code in bombonsec-test-123 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in bugbounty-test-123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22630300fe50578818f50f4a068d400f9e434dc0341fff5a6cd0ca63e82d5e1 The package bugbounty-test-123 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1542 Malicious code in bugbounty-test-123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22630300fe50578818f50f4a068d400f9e434dc0341fff5a6cd0ca63e82d5e1 The package bugbounty-test-123 was found to contain malicious code. Source: ossf-package-analysis...

CVE-2020-7560

A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert all versions and Unity Pro former name of EcoStruxure™ Control Expert all versions, that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control...

Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123

This module enables you to deploy content from one Drupal website to another. The module provides some default configuration without sufficient access control. This vulnerability is mitigated by the fact that an administrator can add some default access control permission...

Malicious code in riyanto-123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ce3d7ef3612a0e7ea2dab5d367b480bcb8a85121a21229686e82d3240d9461f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147415

Malicious code in tusaaya-sdss-123 npm...

MAL-2025-169397 Malicious code in tusaaya-sdss-123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4faab92fd4f8c96a61ac871fa299250c5f77c4080695254f66b1c9fb0bff2edc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

EUVD-2025-35051

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...