CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

GO-2024-2456 vulnerabilities

Vulnerabilities for packages: bom, goreleaser, gitsign, nuclei, go-licenses, gitness, scorecard, src-fingerprint, pulumi-kubernetes-operator...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, scorecard, pulumi-language-dotnet, k8sgpt, zot, grafana-alloy, guac, kots, src-fingerprint, nuclei, pulumi-language-yaml, flux-image-automation-controller, chezmoi, kubescape, go-licenses, gitsign, grype, pulumi, osv-scanner, skaffold,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, scorecard, pulumi-language-dotnet, k8sgpt, zot, grafana-alloy, guac, kots, src-fingerprint, nuclei, pulumi-language-yaml, flux-image-automation-controller, chezmoi, kubescape, go-licenses, gitsign, grype, pulumi, osv-scanner, skaffold,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: kyverno, scorecard, pulumi-language-dotnet, trufflehog, gitaly, zot, grafana-alloy, guac, argo-cd, kots, external-secrets-operator, src-fingerprint, nuclei, rancher-fleet, pulumi-language-yaml, flux-image-automation-controller, steampipe, chezmoi, kubescape, xeol,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, scorecard, skopeo, slsa-verifier, sops, opentelemetry-collector, zot, guac, fulcio, buildkitd, src-fingerprint, nuclei, step-ca, flux-image-automation-controller, rook, tkn, kubescape, flux-image-reflector-controller, gh, gitsign,...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. The API function sshgethexa is vulnerable to a denial-of-service attack when processing zero-length inputs. This vulnerability can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication, if the...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

MAL-2026-13443 Malicious code in diezyyasha-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...

MAL-2026-12127 Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

CVE-2026-24080

Memory Corruption when handling malformed request parameters in the fingerprint TA...

EUVD-2026-52733

Memory Corruption when handling malformed request parameters in the fingerprint TA...

CVE-2026-24080 Buffer Copy Without Checking Size of Input in Biometrics

Memory Corruption when handling malformed request parameters in the fingerprint TA...

CVE-2026-24080

The CVE-2026-24080 entry describes a memory corruption issue in the fingerprint TA when processing malformed request parameters. The vulnerability affects a component related to biometric fingerprint handling and is associated with local attack vector, requiring low privileges and provides no use...

CVE-2026-43730

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. CVE-2026-52720: invalid che...

SUSE-SU-2026:22817-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12891: unchecked aspectratioidc value used as an array index in the H.266 parser could cause a global out- of-bounds read bsc1268872. - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser...

OPENSUSE-SU-2026:21370-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12891: unchecked aspectratioidc value used as an array index in the H.266 parser could cause a global out- of-bounds read bsc1268872. - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser...