CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

Malicious code in @rentwise/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...

WordPress WP Real IP-based Access Control plugin <= 1.3.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Abaid Ur Rehman in WordPress Plugin WP Real IP-based Access Control versions = 1.3.1...

CVE-2026-71246

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

MAL-2026-12200 Malicious code in simple-date-formatter-util-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f8a19e2cff3bcaf070316f16650d8c1af6714f4c44db56971299ef01c16a25 Package advertises itself as a trivial date-formatting utility index.js exports a one-line formatDate wrapper but ships a package.json postinstall ho...

Malicious code in simple-date-formatter-util-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe9863d2e47d22ca16f42efd68d0c79e0b2730b48984bf68b040f6f920fb70ec Package presents itself as a date-formatting utility index.js is a four-line toLocaleDateString wrapper but its package.json postinstall hook runs an...

Malicious code in simple-date-formatter-new-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f5ed3c402677fcfaeac396b55b9db5280445e9b0130133cc311a83f96f2a0de Package advertises itself as a date-formatting utility but its actual behavior on install is credential theft and internal-network reconnaissance. Th...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

UBUNTU-CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

UBUNTU-CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

EUVD-2026-53207

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

MAL-2026-12028 Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

MAL-2026-12001 Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

PT-2026-76201

Summary When fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP,...