Malicious code in ac-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71f97348d3034afc8a89167b165172d331574fdeffd79f9392a282ff5732635f The package ac-array was found to contain malicious code...

MAL-2026-775 Malicious code in ac-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71f97348d3034afc8a89167b165172d331574fdeffd79f9392a282ff5732635f The package ac-array was found to contain malicious code...

OpenSTAManager SQL injection vulnerability

OpenSTAManager is an open-source management software for technical assistance and billing developed by Devcode. Versions of OpenSTAManager prior to v2.9.8 contained a SQL injection vulnerability. This vulnerability stemmed from insufficient validation of the idrecords array in the batch operation...

PT-2026-6774

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and earlier Description OpenSTAManager contains a critical Error-Based SQL Injection issue within the Scadenzario Payment Schedule module’s bulk operations handler. The application does not properly validate that...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

Security Bulletin: Reliability Strategies was using vulnerable library

Summary Reliability Strategies was using vulnerable library qs-6.13.0 which are vulnerable to CVE-2025-15284 Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. SummaryThe arrayLimit...

php security update

An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...

RockyLinux 10 : php (RLSA-2026:1628)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1628 advisory. php: heap-based buffer overflow in arraymerge CVE-2025-14178 php: PHP: Information disclosure via getimagesize function when reading multi-chunk images...

Amazon Linux 2 : rsync, --advisory ALAS2-2026-3157 (ALAS-2026-3157)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3157 advisory. A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a...

CVE-2026-25240

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains when role filters are provided as an array and interpolated into an IN ... clause. This issue has been patched in version 1.33.0...

EUVD-2025-206802

In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe The "index" variable is used as an index into the usbphyc-phys array which has usbphyc-nphys elements. So if it is equal to usbphyc-nphys then it is one element out of bounds. The "index...

CVE-2026-25518: Improper Validation of Array Index

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS...

Linux kernel raid10_run() function Heap Buffer Overflow DoS

The vulnerability of the raid10run function in the drivers/md/raid10.c module of the Linux kernel affects several device-related functions such as RAID and LVM. This vulnerability is related to improper memory release mechanisms memory leaks. Exploiting this vulnerability could allow an attacker ...

CVE-2026-25240

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains when role filters are provided as an array and interpolated into an IN ... clause. This issue has been patched in version 1.33.0...

UBUNTU-CVE-2026-25240

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains when role filters are provided as an array and interpolated into an IN ... clause. This issue has been patched in version 1.33.0...

Security update for php8

This update for php8 fixes the following issues: CVE-2025-14178: heap buffer overflow occurs in arraymerge when the total element count of packed arrays exceeds 32-bit limits or HTMAXSIZE bsc1255711. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:0370-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2025-14178: heap buffer overflow occurs in arraymerge when the total element count of packed arrays exceeds 32-bit limits or HTMAXSIZE bsc1255711...

Malicious code in aligned-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2e1b553bdbf785a336d224d5d3594c204455937469510cdbc423519287b2360 The package aligned-array was found to contain malicious code. Source: ghsa-malware ea83ead9b32cbe9a0c64af15ea5b84c39dad6ba94e7688ec712ceb8d1b2e8185...

Malware in aligned-array

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-670 Malicious code in aligned-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2e1b553bdbf785a336d224d5d3594c204455937469510cdbc423519287b2360 The package aligned-array was found to contain malicious code. Source: ghsa-malware ea83ead9b32cbe9a0c64af15ea5b84c39dad6ba94e7688ec712ceb8d1b2e8185...