MAL-2026-17426 Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17425 Malicious code in kartykgithub-ph-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83e406902c3f8a5a3951ce0c776e78b867e679199c683b67d6f2df8059dcdf72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17424 Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-91129

In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...

PT-2026-104202

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

CVE-2026-104461: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

Flysystem normalizePath() Path Traversal

The vulnerability of the normalizePath function in the src/WhitespacePathNormalizer.php file of the Flysystem library is related to the failure to take measures to eliminate special elements. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the protected...

Gitea EditReleasePost UpdateRelease Data Compromise

The vulnerability of the EditReleasePost function in the routers/web/repo/release.go file and the UpdateRelease function in the services/release/release.go file of the Git repository management system Gitea is related to the use of names with incorrect links. Exploiting this vulnerability could...

Missing Authentication in Brocade ASCGStreaming Service (CVE-2026-85421)

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

PT-2026-104271

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

Tenable Nessus < 10.12.5 Multiple Vulnerabilities (TNS-2026-26)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-26 advisory. - Nessus did not sufficiently verify the integrity of certain downloaded content...

MAL-2026-17423 Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-73975

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...

CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...

CVE-2026-73975

The research data repository system djehuty , developed by 4TU.ResearchData, is vulnerable to an authenticated SPARQL injection in versions prior to 26.3.2 . An authenticated depositor can supply a crafted session name to inject arbitrary SPARQL into state-modifying (DELETE/INSERT ) queries. This...

EUVD-2026-90924

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...