MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

UBUNTU-CVE-2026-61893

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an...

CVE-2026-63033

The connected records identify this CVE as affecting MZ Automation’s lib60870 library and describe an out-of-bounds read: A crafted IEC 60870-5-104 I-frame with a declared object count that exceeds the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap...

SUSE-SU-2026:3417-1 Security update for apptainer

This update for apptainer fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invali...

PT-2026-66630

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crafted IEC 60870-5-104 I-frame with TypeID 104 C TS NA 1 and an inflated object count causes the TestCommand getFromBuffer function to read one byte past the...

CVE-2026-56852 affecting package prometheus-process-exporter for versions less than 0.8.2-5

CVE-2026-56852 affecting package prometheus-process-exporter for versions less than 0.8.2-5. A patched version of the package is available...

CVE-2026-56852 affecting package prometheus-node-exporter for versions less than 1.7.0-5

CVE-2026-56852 affecting package prometheus-node-exporter for versions less than 1.7.0-5. A patched version of the package is available...

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5. A patched version of the package is available...

CVE-2026-14996

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. Mitigati...

CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL error message handling process. An attacker can obtain the names of required custom inp...

PT-2026-64437

These are all security issues fixed in the libsrt1 5-1.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication

The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

PT-2026-62011

Malcolm v26.07.0 adds IEC 60870-5-104 IEC 104 protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improv...

Security update for afterburn

This update for afterburn fixes the following issues: Update to version 5.10.0.git73.b97f772. Security issues fixed: CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270175. CVE-2026-41677: openssl: out-of-bounds read in PEM password...

CVE-2026-37555 affecting package libsndfile for versions less than 1.2.2-5

CVE-2026-37555 affecting package libsndfile for versions less than 1.2.2-5. A patched version of the package is available...

PT-2026-57299

RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange...

Siemens SIPROTEC 5 Using DIGSI5 Protocol Unrestricted Upload of File with Dangerous Type (CVE-2025-40808)

The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution. This plugin only works with Tenable.ot...