EUVD-2026-27043

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client udhcpc6 DNSSERVERS option handler in networking/udhcp/d6dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6OPTDNSSERVER...

Arbitrary Code Injection

Overview org.apache.atlas:atlas-repository is an Apache Atlas Repository Module Affected versions of this package are vulnerable to Arbitrary Code Injection in the DSL search endpoint. An attacker can execute arbitrary code by placing malicious Gremlin traversal logic within grammar-allowed...

Malicious code in api-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a549cfdf0cbbfa203632d6fe432f69fa60578b8d81b03b75c2bece912aa0c588 The package api-typings was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3329 Malicious code in api-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a549cfdf0cbbfa203632d6fe432f69fa60578b8d81b03b75c2bece912aa0c588 The package api-typings was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3330 Malicious code in seek-pass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df5ea10e9459dff09eeff2b45d93b1ffa2458c8b38b7625850b5f2564e3d000f The package seek-pass was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in seek-pass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df5ea10e9459dff09eeff2b45d93b1ffa2458c8b38b7625850b5f2564e3d000f The package seek-pass was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in pocpoc2626 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a43e5357592b2bbbe0c68be3960ac829ab988a15b57d63df5ab954c9d0b5b09 The package pocpoc2626 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3328 Malicious code in pocpoc2626 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a43e5357592b2bbbe0c68be3960ac829ab988a15b57d63df5ab954c9d0b5b09 The package pocpoc2626 was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-40563

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...

MAL-2026-3327 Malicious code in capacitor-plugin-service-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f1958d8bc44724a00d45b291983ad836dc2f28370c27f83c76f7bf1780bd4b The package capacitor-plugin-service-worker was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in capacitor-plugin-service-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f1958d8bc44724a00d45b291983ad836dc2f28370c27f83c76f7bf1780bd4b The package capacitor-plugin-service-worker was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3326 Malicious code in paychex-common-vendor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d8076c0caa289734b5a30b904f9a075ae0d55ea3fc74f665806d913efe7d28 The package paychex-common-vendor-lib was found to contain malicious code. Source: ghsa-malware...

Malicious code in paychex-common-vendor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d8076c0caa289734b5a30b904f9a075ae0d55ea3fc74f665806d913efe7d28 The package paychex-common-vendor-lib was found to contain malicious code. Source: ghsa-malware...

JLSEC-2026-419 When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's...

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...

JLSEC-2026-392

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl 7.84.0 stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger th...

CVE-2026-29199

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Hos...

Malicious code in feature-flag-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ba3fb4537827a604de645ffad07771bc9f7ed4e1f4a70b16b4c35effadcf744 The package feature-flag-service was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in internal-company-module-test-1337 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa107cadda6301a772af8727ebafd976365c28371cddd211c176a57b12715d9 The package internal-company-module-test-1337 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3249 Malicious code in internal-company-module-test-1337 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa107cadda6301a772af8727ebafd976365c28371cddd211c176a57b12715d9 The package internal-company-module-test-1337 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3241 Malicious code in nextjs-chat-with-ai-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ff3e52e4957291f626e1225ab3b81194c80cd8c6037f943298f6170f98dbe9b The package nextjs-chat-with-ai-service was found to contain malicious code. Source: ghsa-malware...