UBUNTU-CVE-2026-11526

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle. GD::Image::makefilehandle opens a filename argument with Perl's 2-arg open, so a filename that begins or ends with a pipe "| cmd", "cmd |" or begins with a...

CVE-2026-12089

creationtimestamp| type| source ---|---|--- 2026-06-13 05:32:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo5jqc7yxl2b...

CVE-2026-48049 vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-12043

CVE-2026-12043 affects the AWS Common Runtime aws-c-http library due to improper handling of HPACK dynamic table size updates, which can cause memory corruption on a connecting client via a crafted sequence of HTTP/2 HEADERS frames. The vulnerability could lead to arbitrary code execution on vuln...

CVE-2026-12143

creationtimestamp| type| source ---|---|--- 2026-06-12 18:00:49+00:00| published-proof-of-concept| https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx 2026-06-12 21:57:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4qbo7oof23 2026-06-16 12:01:29+00:0...

CVE-2026-50087

The Aqara IAM/SSO gateway gw-builder.aqara.com exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N 8.2 High...

Security Bulletin: The IBM Common Licensing product using WebSphere Application Server Liberty is affected by a remote code execution vulnerability (CVE-2025-14914)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a cross-site scripting vulnerability with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature enabled, due to improper validation of user-supplied input. An attacker could...

CVE-2026-11664 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-47838

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

MAL-2026-5654 Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-6277

creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260612...

CVE-2026-41699

creationtimestamp| type| source ---|---|--- 2026-06-11 08:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnyr2ucwjy2n 2026-06-11 09:26:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnyvujrrsc2i 2026-06-14 23:17:06+00:00| seen|...

CVE-2026-46520

creationtimestamp| type| source ---|---|--- 2026-06-11 05:02:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnygzyjcyh2n...

Malicious code in @coze-common/chat-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89b49d08422192fa57b4739bf462f0e8b3c206b2c3cfad15578ac92dd6f47b04 This package is a dependency-confusion/namespace-squat against ByteDance's @coze-common scope. The library is hollow — index.js is module.exports = a...

CVE-2026-45257

creationtimestamp| type| source ---|---|--- 2026-06-10 21:43:33+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnxoldhoq72z 2026-06-10 22:08:57+00:00| seen| https://bsky.app/profile/andersonc0d3.bsky.social/post/3mnxpyp62lc2t 2026-06-11 00:53:06+00:00| seen|...

CVE-2026-46612

creationtimestamp| type| source ---|---|--- 2026-06-10 19:17:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgfz4oop24...

Malicious Package

Overview npmjsweb3-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-5510 Malicious code in npmjs_web3-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b691e4c1a13cf8174fdf8653d757594f18057650310bc89e376caa806602d3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview npmjsethers-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...