CVE-2026-73051

CVE-2026-73051 affects actix-http before 3.12.1. The HTTP/1.1 parser accepts requests with both Content-Length and Transfer-Encoding: chunked headers, enabling HTTP request smuggling. Unauthenticated remote attackers could use a front-end intermediary to desynchronize backend requests and smuggle...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

EUVD-2026-58628

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

MAL-2026-14083 Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-19822

CVE-2026-19822 affects Tenda W20E (QoS Edit) where the function lstAdd in /goform/editQos can be coerced by manipulating qosListConnecttedNum, causing a stack-based buffer overflow. The issue may be exploitable remotely, and publicly available exploit details are noted. Exploitation status and pr...

EUVD-2026-58624

A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. T...

MAL-2026-14081 Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-19821

A vulnerability was determined in Tenda AC12 15.03.06.23multiTD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack ma...

EUVD-2026-58616

A vulnerability was determined in Tenda AC12 15.03.06.23multiTD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack ma...

CVE-2026-19821 Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow

A vulnerability was determined in Tenda AC12 15.03.06.23multiTD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack ma...

MAL-2026-14092 Malicious code in rimo-env-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56f06dbeb4a580e0e33781dc75aeea4c844f8de804be52f0a43097d85739c53c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14079 Malicious code in elf-stats-cranberry-wishlist-933 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fcbc300aedf740c98f076d87915e27c394b15951161ba52fb5a0583b9585770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14087 Malicious code in mw-filesystem-events-nodream-es6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e79317db717bd6c38646bef40f0e5205e0f42a3174319f95d9b5e7153cc8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware

Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks. In a statement shared with TechCrunch, the iPhone maker said it alerted an unspecified number of users targeted in 110 countries and that it has notified...

MAL-2026-14080 Malicious code in expect-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17d9530bd098ecda5041341a338be1a2cfaab1f19e907252bbc95cdd2577dba1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-19815

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible...

CVE-2026-19815 TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible...

CVE-2026-19815

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible...