Malicious code in @copilot-mcp/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95a10852a2ffe12a9d2b124d014e2092dc2f2d45821ab92feae8cb5308b94ea install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript with 'do shell script' on macO...

MAL-2026-12445 Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

CVE-2026-71267

CVE-2026-71267 affects microtar. The mtar_write_file_header() and mtar_write_dir_header() functions copy a caller-supplied entry name into a 100-byte name field of a stack-allocated mtar_header_t using strcpy without validating length, allowing a stack buffer overflow if the filename is longer th...

EUVD-2026-53352

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy. Any application that calls these...

CVE-2026-71265

CVE-2026-71265: Domoticz MochadTCP::MatchLine() for MOCHAD_RFSEC messages copies up to 1028 bytes from m_mochadbuffer into a fixed 50-byte tempRFSECbuf using strcpy() without length checks, across three device branches (DS10A/KR10A/MS10A). An attacker on the local network that can reach the Mocha...

Malicious code in quorvex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...

MAL-2026-12487 Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

EUVD-2026-53336

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534768cd8d709ca1a5701f182e4e509713821923b6995a2bb868d79b0fdded62 On require of the package index.js loads./vendor at import, vendor.js selects a platform-specific staging path, downloads a binary from a rotated lis...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

SonicOS Improper Neutralization of HTTP Headers Vulnerability

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains. CVE: CVE-2026-0516 Last updated: Aug. 11, 2026, 1:23 p.m...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-71252

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx: The MailAccountViewSet.test() action can reuse stored credentials (IMAP password/OAuth token) from an existing account when a caller with object-level change_mailaccount permission redirects the test connection to an attacker-controlled IMAP host, causing exposure of real credentia...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...