MAL-2026-16157 Malicious code in @merazmz/project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16159 Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-90957

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, and Oracle GraalVM for JDK products of Oracle Java SE component: Libraries. The supported versions affected by this vulnerability are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise...

Astra Linux – Vulnerability in Chromium

The use of uninitialized variables in Skia in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in Visuals in Google Chrome before version 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Integer overflow in the libyuv component in Google Chrome prior to version 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in rpm

A flaw was discovered in the RPM package’s read functionality. This flaw allows an attacker to persuade a victim to install a seemingly verifiable package, or to compromise an RPM repository, thereby causing corruption of the RPM database. The most significant threat posed by this vulnerability i...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. The supported versions affected by this vulnerability are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4, and 22.3.0...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Swing. The supported versions affected include Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5, and 22.3.1. This easily...

Astra Linux – Vulnerability in openjdk-11

A vulnerability exists in the Oracle Java SE and Oracle GraalVM Enterprise Edition products developed by Oracle Java SE component: Hotspot. The versions affected include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable...

Astra Linux – Vulnerability in Thunderbird

When importing a revoked key with “key compromise” as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked. As a result, the existing key remained unrevoked. Revocation statements that used another revocation reason, or those that did not specify...

Astra Linux – Vulnerability in Chromium

The use of after-free in WebRTC in Google Chrome before version 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Mariadb 10.3

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. The supported versions affected are 5.7.33 and earlier. This easily exploitable vulnerability allows a highly privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats()

A flaw was found in PostgreSQL. An object creator can exploit a type confusion vulnerability in the pgrestoreattributestats function. This flaw occurs due to the conflation of range and multirange values, allowing the attacker to execute arbitrary code as the operating system user running the...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

CVE-2026-7884: Improper Neutralization of Input During Web Page Generation

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

ROS-20260914-73-0010

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to compromise the integrity of the data...