EUVD-2026-84357

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

CVE-2026-63278

LibreOffice is affected by an information-disclosure vulnerability in its package URL handling . The check introduced for CVE-2024-12426 did not recognize every naming variation of the package content provider , allowing a crafted URL to still reach the expansion logic and exfiltrate environment ...

CVE-2026-63278: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: corelinecards: Fixed double memory deallocation in case of an invalid INI file. In the case of an invalid INI file, mlxswlinecardtypesinit deallocates memory, but does not reset the pointer to NULL and returns 0. If any...

Astra Linux – Vulnerability in node-ini

This affects the package ini before version 1.3.6. If an attacker submits a malicious INI file to an application that parses it using ini.parse, they will corrupt the prototype within the application. This can be further exploited depending on the context...

Malicious code in ini-supervisor-ini-enif (npm)

Source: amazon-inspector b29a32dd2b265a29cfbec53f5ec524396621a56b1ac1096d46802296fb8d328f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

ROOT-APP-NPM-CVE-2020-7788 CVE-2020-7788 in ini - Patched by Root

Root has patched CVE-2020-7788 in the ini package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview algol-upgrade-ini-acamar is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: flux, k3s, src, kube-logging-operator, cerbos, guac, portieris, render-template, trivy, aws-application-networking-k8s, chart-testing, docker-machine-driver-harvester, nri-redis, harbor-cli, envconsul, tflint, nats-server-config-reloader, fulcio, cloud-sql-proxy,...

CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CLSA-2026-1775608289 TuxCare security update for ini (1 CVE)

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.3-tuxcare.1...

CLSA-2026-1771546204 TuxCare security update for ini (1 CVE)

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.5-tuxcare.2...

CLSA-2026-1771546203 TuxCare security update for ini (1 CVE)

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.5-tuxcare.1...

PT-2026-73771

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.5-tuxcare.1...

PT-2026-73772

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.5-tuxcare.2...

PT-2026-74372

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.3-tuxcare.1...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21500-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21500-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

Security update for yq (important)

openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21500-1 Rating: important References: bsc1267199 bsc1271994 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...

SUSE CVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

OPENSUSE-SU-2026:21500-1 Security update for yq

This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix:...