CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2022-4993

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

Malicious code in npm-hex-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to...

Malicious code in js-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe The npm package js-assert-plus masquerades as an assertion library homepage http://js-assert-plus.com and bundles the real chai source so consumers g...

MAL-2026-13954 Malicious code in minimalistic-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75 The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require'minimalistic-assert-plus',...

Malicious code in minimalistic-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75 The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require'minimalistic-assert-plus',...

MAL-2026-13958 Malicious code in power-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...

Malicious code in power-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...

Malicious code in postcss-initialize-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Malicious code in finvu-hdfc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d8b7aaf87c416d1ac2144be116de9085318fa6991c455346596ddc26a676f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] [DSA 6437-1] apr-util security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6437-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2026 https://www.debian.org/security/faq -...

CVE-2026-24059

The CVE-2026-24059 detail shows a flaw in the Gitea runner registration-token GET endpoint: when invoked at project- or owner-level, it creates a new runner registration token if none exists, but is gated by a read-only scope. A leaked read:user-scoped token can therefore mint a registration toke...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-67986

A flaw was found in amazingprint. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. The flaw occurs when the grep method is called with a block, and a specially crafted method name containing Ruby interpolation syntax is processed. Successful...

Malicious code in @caspianph/third-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb03109285cde39b5336360926e9efaef2dd1ea20725eda1455e1ca5ec4b633e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-13048

Data::MuForm::Localizer for Perl (through v0.05) is vulnerable. load_lexicon constructs catalog paths using Messages/$lang.po without validating bare locale tags, enabling ../ path traversal and loading of arbitrary .po files. While parsing, the code evaluates header-derived content (Plural-Forms...