CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management interface, affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1 . The root cause is a failure to properly validate and sanitize a user-supplied status file path parameter during configuration ...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

MAL-2026-17650 Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

PT-2026-107852

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-87685: External Control of File Name or Path

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

PT-2026-108217

Name of the Vulnerable Software and Affected Versions Deskin versions prior to 3.3.4.4 Description A privilege escalation issue exists in the com.deskin.service.installer XPC service. Local unprivileged attackers can connect to this root-owned service without authentication to execute arbitrary...

PT-2026-107796

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

Rocky Linux 10.2 [CIQ] Security Update: rpm-sequoia / rpm-sequoia-debuginfo / rpm-sequoia-devel / etc (crlsa-2026_76734)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676734 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Uninformative error messa...

CVE-2026-85421: Missing Authentication for Critical Function

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

Rocky Linux 10.2 [CIQ] Security Update: rust-sequoia-sqv-debugsource / sequoia-sqv / sequoia-sqv-debuginfo (crlsa-2026_76735)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

AlmaLinux 10 : rust-sequoia-sq (ALSA-2026:76737)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:76737 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from...

Malicious code in function-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551ba64ea86ca7d7839dcd058b2c567604c534134e2a6e13f84af340c2db4aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17647 Malicious code in function-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551ba64ea86ca7d7839dcd058b2c567604c534134e2a6e13f84af340c2db4aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17648 Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-69QC-F5M6-889C Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

Ghost: Stored XSS via Embed Card Previews

Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session...

EUVD-2026-92633

Ghost : Stored XSS via SVG Files in Content Imports...

GHSA-HQQ2-XQR2-FMX2 Ghost : Stored XSS via SVG Files in Content Imports

Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...