Malicious code in express-fork (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

EUVD-2026-91834

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

PT-2026-104569

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description Validation of an MLS RFC 9420 external commit's proposal list in the validateExternalCachedProposals function of org.bouncycastle.mls.protocol.Group failed to verify that a removed leaf...

CVE-2026-94591

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

CVE-2026-94594

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-94591

Armatura One is vulnerable to the compromise of database and message-broker credentials due to a hard-coded cryptographic key (CWE-321 ). When the software's protection is enabled, it encrypts these credentials using AES-128-CBC ; however, the encryption key and initialization vector are fixed va...

CVE-2026-94591 Armatura LLC Armatura One Use of Hard-coded Cryptographic Key

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

CVE-2026-94591 Armatura LLC Armatura One Use of Hard-coded Cryptographic Key

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-104859

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104901

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

EUVD-2026-91672

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

CVE-2026-104901 MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

CVE-2026-104901

MISP is vulnerable to a cross-site scripting (XSS) flaw in its ID Translator feature. When an authenticated user views the ID Translator page, the application queries linked remote MISP servers for event identifiers. The software fails to perform proper output encoding on these returned IDs, allo...

CVE-2026-104901

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

Malicious code in dedh-devops-automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

httpd: httpd: Authentication bypass via credential replay in mod_auth_digest

A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...

PT-2026-104360

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

PT-2026-104436

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description Armatura One stores database and message-broker credentials in an installation configuration file. When protection is enabled, these credentials are encrypted using AES-128-CBC Advanced...

Sensitive Credential Exposure via Unredacted REST Endpoint Response in Brocade ASCG before 3.5.0 (CVE-2026-87428)

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...