UBUNTU-CVE-2026-58221

Samba AD authenticated LDAP access domain takeover. Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover...

UBUNTU-CVE-2026-6949

TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

MAL-2026-11118 Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

Malicious code in num-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001 Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via...

MAL-2026-11107 Malicious code in num-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001 Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via...

Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

MAL-2026-11106 Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

CVE-2026-50134

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, by controlling a server or its DNS, to redirect HTTP requests to a forbidden host. This bypasses the intended security policy, potentially leading to unauthorized access to resources or information disclosur...

Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

MAL-2026-11108 Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

CVE-2026-16422

A flaw was found in Google Chrome. Insufficient validation of untrusted input in the Certificate component allows an attacker in a privileged network position to perform domain spoofing. This can be achieved by sending malicious network traffic, leading to a user being misled about the authentici...

PT-2026-65471

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

PT-2026-65460

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN DOMCTL get domain state was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQ DOM EXC virtua...

RockyLinux 8 : unbound (RLSA-2026:37282)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37282 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

PT-2026-65615

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description A server-side request forgery SSRF exists due to a time-of-check/time-of-use TOCTOU gap during DNS resolution. The software validates the resolved IP of a fetch target to block...

RHEL 8 : firefox (RHSA-2026:47105)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47105 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom:...

PT-2026-65629

It was discovered that Samba's pam winbind incorrectly handled home directory ownership when mkhomedir was enabled. A local attacker could possibly use this issue to cause a denial of service by triggering a change in ownership of the root directory. CVE-2026-15779 Arjun Basnet, Douglas Bagnall,...