CVE-2026-24048

CVE-2026-24048 affects Backstage FetchUrlReader in @backstage/backend-defaults prior to v0.12.2, v0.13.2, v0.14.1, and v0.15.0. The component would follow HTTP redirects, enabling an attacker who controls a host in backend.reading.allow to redirect requests to internal/sensitive URLs outside the ...

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

Impact The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the...

libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...

Malicious code in @kyriba/platform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0a71fe72adcafe15eaf177857304a4032df3f3b0d15cc0d169a54d666f26be9 The package @kyriba/platform-frontend was found to contain malicious code. Source: ghsa-malware...

MAL-2026-380 Malicious code in @kyriba/platform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0a71fe72adcafe15eaf177857304a4032df3f3b0d15cc0d169a54d666f26be9 The package @kyriba/platform-frontend was found to contain malicious code. Source: ghsa-malware...

MAL-2026-385 Malicious code in blocks-builder-manifest-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30f5efa34a1c44d974502110177cb7a60daf579349ed25937e66e342f7f7c24f The package blocks-builder-manifest-generator was found to contain malicious code. Source: ghsa-malware...

Server-Side Request Forgery (SSRF)

Umbraco CMS is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the baseUrl parameter in dashboard and help controller endpoints, which allows an attacker to craft requests that force the server to make unauthorized requests to external hosts...

MAL-2026-369 Malicious code in mw-shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf3e97618076e4e55a66ab4e6db0bd9af5787726d301e9cd90b7884efd085977 The package mw-shared-utils was found to contain malicious code. Source: ghsa-malware fc9d8c69691da9ebbb33986c4ad9eb26e4c1209546e369313ae26ff09cc378c...

Malicious code in mw-shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf3e97618076e4e55a66ab4e6db0bd9af5787726d301e9cd90b7884efd085977 The package mw-shared-utils was found to contain malicious code. Source: ghsa-malware fc9d8c69691da9ebbb33986c4ad9eb26e4c1209546e369313ae26ff09cc378c...

Malicious code in shared-global-ec-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac32ab19d7e9c15b0c6a69dafe143c75cab5612b903293c16865f371b8a00a7 The package shared-global-ec-uikit was found to contain malicious code. Source: ghsa-malware...

PT-2026-3744

Impact If Windows MDM is enabled, an attacker could exploit a cross-site scripting XSS vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser. A compromised...

MiracleLinux 8 : systemd-239-68.el8.4 (AXSA:2023-5147:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5147:05 advisory. systemd: local information leak due to systemd-coredump not respecting fs.suiddumpable kernel setting CVE-2022-4415 Tenable has extracted the preceding...

Malicious code in internallib_v355 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dba9a4166fd959eea5357952f1ffba736b4e6c9176ddeff85e0aeb1592edef8 The package internallibv355 was found to contain malicious code. Source: ghsa-malware 41e49779a105339cef2addb161d2a79d3aa2e22201f862ba6c3ef2af1ab1ccd...

Linux Distros Unpatched Vulnerability : CVE-2026-23884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves gdi-drawing pointing to freed memory,...

Linux Distros Unpatched Vulnerability : CVE-2026-22865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, so...

DEBIAN-CVE-2026-22816

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these...

CVE-2026-22816

CVE-2026-22816 (Gradle) : Multiple sources describe a vulnerability in Gradle before 9.3.0 where non-fatal exceptions during dependency resolution would allow Gradle to continue to the next repository, and an unresolvable host name could let an attacker register a service under the build’s host n...

CVE-2026-22816

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001591)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001591 advisory. A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flagTF bit in EFLAGS during emulation of the syscall instructio...

Dive code injection vulnerability

Dive is a desktop application for MCP hosts, open-sourced by OpenAgentPlatform. Versions of Dive prior to 0.13.0 contained a code injection vulnerability. This vulnerability stemmed from specially crafted deep links that allowed the installation of MCP server configurations controlled by attacker...