membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

EUVD-2026-36235

membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...

GHSA-43HJ-FXWJ-49QW membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105: Exposure of Sensitive Information to an Unauthorized Actor

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-67585

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

EEF-CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Summary Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandat...

EUVD-2026-54531

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

CVE-2026-67585

The CVE-2026-67585 entry concerns DivvyPayHQ absinthe_federation. An unauthenticated remote attacker can cause the Erlang VM to abort by crafting _entities representation keys. The root cause is that every key in representations is converted to an atom via String.to_atom/1, and since representati...

CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

MAL-2026-13284 Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

MAL-2026-12859 Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...