CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind (FasterXML Jackson Data Processor) is affected by an incomplete fix for CVE-2026-54514. The java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization. Th...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-76838

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

EUVD-2026-65010

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

ROOT-OS-DEBIAN-13-CVE-2026-55973 CVE-2026-55973 in unbound - Patched by Root

Root has patched CVE-2026-55973 in the unbound package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-44690 CVE-2026-44690 in unbound - Patched by Root

Root has patched CVE-2026-44690 in the unbound package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-32665 CVE-2026-32665 in unbound - Patched by Root

Root has patched CVE-2026-32665 in the unbound package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-40691 CVE-2026-40691 in unbound - Patched by Root

Root has patched CVE-2026-40691 in the unbound package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-50252 CVE-2026-50252 in unbound - Patched by Root

Root has patched CVE-2026-50252 in the unbound package for Root:Debian:13. Multiple fixed versions available...

Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

Malicious code in paypal-business-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent...

Malicious code in manticore-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184c02a26613b94b15f0abe1ed108c7a2a7a061f795213dba4772876e6e0a015 The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hostname, current working...

Malicious code in ppb-manticore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...

Malicious code in @gsas/gsas-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2242b683433d5fe37b3997185d251799a4606a456e516da08586775d11f0cb7e @gsas/[email protected] is a high-version public-registry squat targeting an internal @gsas/gsas-sdk name. package.json declares preinstall: node...

Malicious code in web-advertising (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...

K000163001: NLnet Labs Unbound vulnerability CVE-2026-42923

Security Advisory Description NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to...