Malicious code in datefmt-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...

RLSA-2026:54512 Moderate: gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 For more details about the...

gnome-remote-desktop security update

An update is available for gnome-remote-desktop. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNOME Remote Desktop is a remote desktop and screen sharing...

GO-2025-3646 vulnerabilities

Vulnerabilities for packages: k3s...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Oracle Linux 10 : gnome-remote-desktop (ELSA-2026-54512)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-54512 advisory. 49.3-4 - Backport connection throttling Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Ness...

AlmaLinux 10 : gnome-remote-desktop (ALSA-2026:54512)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:54512 advisory. gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 Tenable h...

RockyLinux 10 : gnome-remote-desktop (RLSA-2026:54512)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54512 advisory. gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 Tenable...

AZL-96680 CVE-2026-56853 affecting package golang 1.26.7-1

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

DEBIAN-CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853

The golang language (specifically the net/[http:] package) is vulnerable to a Denial of Service attack when a server is configured to support unencrypted HTTP/2. The issue occurs because the server reads the HTTP/2 client preface from new connections without applying the ReadHeaderTimeout , allow...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary: A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause: Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handshake process. An attacker can exhaust all available connection slots by initiating multiple simultaneous connections and stalling the handshake, either before or afte...

Malicious code in date-fmt-utils-helper (npm)

Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a disguise. The package.json postinstall hook runs node...

Malicious code in date-fmt-helper-xz (npm)

Source: amazon-inspector b384650ec0fabdd01a7dfc513cccd25156611a04c17ba0c435b950ddb9215777 date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host 8.135.48.40 on port 4444 and pipes /bin/sh stdio over the...

CVE-2026-73561

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...

CVE-2026-15972

A flaw was found in Consul. A remote attacker can exploit this vulnerability by sending numerous incomplete connection requests to the external gRPC gRPC Remote Procedure Call listeners. This unbounded connection acceptance can exhaust agent resources, such as file descriptors, goroutines, and...

Malicious Package

Overview index-design-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...