MAL-2026-7317 Malicious code in manage-subscription-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in liportal-web-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7313 Malicious code in liportal-web-app (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-41434

A flaw was found in OP-TEE Open Portable Trusted Execution Environment, a secure environment for Arm Cortex-A cores. This vulnerability allows a local attacker with low privileges to trigger an unbounded recursion within the PKCS11 Trusted Application TA. Successful exploitation could lead to a...

Malicious code in bitu-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7219 Malicious code in bitu-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @jesusvizcaino2021/app-push-base (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7078 Malicious code in @jesusvizcaino2021/app-push-base (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @app-tray-ui/stencil-component (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7036 Malicious code in @app-tray-ui/stencil-component (npm)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1931 social-auth-app-django affected by Improper Handling of Case Sensitivity

Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix...

CVE-2026-34170

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170

CVE-2026-34170 affects Coolify before 4.0.0-beta.471, where the GithubApp api_url field is used as the base URL for server-side HTTP requests without proper allowlisting or private IP blocking. An authenticated user can configure a GitHub App source that makes Coolify issue requests to internal s...

CVE-2026-34170

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

EUVD-2026-41997

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

SUSE CVE-2026-13852

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-13881

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...