CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

GHSA-4GP8-RJRQ-CH6Q link-preview-js vulnerable to IPv6 and internal loopback attacks

Impact The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. Patches Problem has been patched in version 4.0.1. However, it cannot be completely solved by the package alone. T...

CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

CVE-2026-44331

ProFTPD vulnerable: versions up to 1.3.9a before 7666224 are affected by a SQL injection in sqltab_fetch_clients_cb() (contrib/mod_wrap2_sql.c). An attacker can inject arbitrary SQL via a crafted domain name accessed during reverse DNS lookups when UseReverseDNS is enabled, because the attacker-s...

CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

CVE-2026-44331

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the...

Malicious code in @rivianlabs/bedrock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d12061e491ebc9109496b77ffd62384bba9a781ac9f0579343a61c5742df351 The package @rivianlabs/bedrock was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3348 Malicious code in @rivianlabs/bedrock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d12061e491ebc9109496b77ffd62384bba9a781ac9f0579343a61c5742df351 The package @rivianlabs/bedrock was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-32936

CVE-2026-32936 – CoreDNS DoH GET path size validation issue . In CoreDNS (prior to 1.14.3), the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameters and performs parsing, base64 decoding, and DNS message unpacking before rejection. Unlike the POST path, there is no equivalent siz...

CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC DoQ server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a...

CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC DoQ server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a...

Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97811e59906bdddcec41925a93555ce170bea51f0526e0b34d15e016f5fd1f6b The package @rivianlabs/dc-fe-app-web-rivian-com was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3349 Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97811e59906bdddcec41925a93555ce170bea51f0526e0b34d15e016f5fd1f6b The package @rivianlabs/dc-fe-app-web-rivian-com was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports DoT, DoH, DoH3, DoQ, and gRPC because it trusts the transport writer's TsigStatus instead of performing verification itself. The DoH and DoH3 writer's TsigStatus...

Malicious code in @rivianlabs/dt-shop-bag-v0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4117faebfc77cf01d1cf1bb6e5c6c2e9dda679d8f976eb5308a585016f3f5f The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3351 Malicious code in @rivianlabs/dt-shop-bag-v0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4117faebfc77cf01d1cf1bb6e5c6c2e9dda679d8f976eb5308a585016f3f5f The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @rivianlabs/dt-lib-lumberjack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf3a31f76f8c2e22a2792aee30736347d17fe5872cb69c7edaecc7728aa6190 The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3350 Malicious code in @rivianlabs/dt-lib-lumberjack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf3a31f76f8c2e22a2792aee30736347d17fe5872cb69c7edaecc7728aa6190 The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code. Source: ossf-package-analysis...