Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

MAL-2026-12219 Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

UBUNTU-CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572

CVE-2026-64572 affects the Linux kernel's IPv4 FIB path. In fib_table_insert(), new_fa is published to the leaf’s fa_list before notifiers run; if a notifier fails, the code removes new_fa via fib_remove_alias() and frees it with kmem_cache_free(). A concurrent, already-reached reader in fib_tabl...

MAL-2026-12028 Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

Exposure of System-scoped credentials in google-chat-notification

google-chat-notification 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials...

UBUNTU-CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

CVE-2026-9390 affects XML::Sig (Perl) versions before 0.71. The issue arises when verify()/_get_signed_xml() build XPath expressions by concatenating SignedInfo/Reference/@URI from the document without escaping or enforcing NCName rules. A URI containing a single quote can terminate the string li...

CVE-2026-68742

A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...

CVE-2026-67288

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache...

UBUNTU-CVE-2026-67288

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache...

CVE-2026-67288 FreeRDP before 3.29.0 Denial of Service via smartcard cache

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache...