Malicious code in sc-announcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c [email protected] ships an empty stub module.exports = and declares a single dependency ltidisafe sourced from an off-registry HTTPS tarball URL...

Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5 package.json declares a dependency ltidisafe sourced directly from the bare HTTPS URL...

MAL-2026-18063 Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5 package.json declares a dependency ltidisafe sourced directly from the bare HTTPS URL...

Malicious code in ccl-global-shopping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz...

MAL-2026-18061 Malicious code in ccl-global-shopping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz...

MAL-2026-18062 Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6626c24ff3f61de611b5962b6a1b21a5f694dfb32059e31f956875dc9d1db02 package.json declares the package's only dependency ltidisafe as a direct HTTPS tarball URL...

Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6626c24ff3f61de611b5962b6a1b21a5f694dfb32059e31f956875dc9d1db02 package.json declares the package's only dependency ltidisafe as a direct HTTPS tarball URL...

Linux Distros Unpatched Vulnerability : CVE-2026-98690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on...

Atlassian Jira Service Management Data Center and Server < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16793)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16793 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix...

GO-2026-6739 Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-111749

A flaw was found in aiohttp. When processing HTTP cookies, a response from an untrusted subdomain can remove the Host-Only attribute from an existing parent-domain cookie. This vulnerability allows an attacker controlling a subdomain to bypass domain isolation protections, potentially exposing...

PrivEsc (Priviledge Escalation) org.apache.tomcat:tomcat-coyote Dependency in Crowd Data Center

This High severity PrivEsc Priviledge Escalation vulnerability was introduced in version 7.2.0 of Crowd Data Center. This PrivEsc Priviledge Escalation vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows an unauthenticated attacker to...

Froxlor authorization issue vulnerability

Froxlor versions 0.10.0 to 2.3.15 have an authorization issue. This vulnerability stems from the SubDomains.delete API command lacking proper authorization. Certified customers can delete the main domain name by providing the main domain ID, bypassing the Web UI restrictions for domain name...

MAL-2026-17943 Malicious code in vinted-mocked-apis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf The OpenSSF Package Analysis project identified 'vinted-mocked-apis' @ 99.0.0 pypi as malicious. It is considered malicious because: - The packa...

Permissive Cross-domain Policy with Untrusted Domains

Overview org.apache.camel:camel-jetty-common is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the enableCORS configuration in the Jetty...

CLSA-2024-1724774331 kernel: Fix of 12 CVEs

drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - afunix: Fix garbage collector racing against connect CVE-2024-26923 - ipv6: remove maxsize check inline with ipv4 CVE-2023-52340 - aoe: fix the potential use-after-free problem in aoecmdcfgpkts CVE-2023-6270 - smb: client:...

CLSA-2024-1725187614 kernel: Fix of 12 CVEs

drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - afunix: Fix garbage collector racing against connect CVE-2024-26923 - ipv6: remove maxsize check inline with ipv4 CVE-2023-52340 - aoe: fix the potential use-after-free problem in aoecmdcfgpkts CVE-2023-6270 - smb: client:...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

CVE-2026-98437

A flaw was found in the Linux kernel's Qualcomm Iris video driver. A local user could cause a Denial of Service DoS or resource exhaustion through improper error handling during power domain configuration. When enabling or disabling power domains encounters an error, the driver fails to properly...

CVE-2026-85313

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...