CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

MAL-2026-12104 Malicious code in @wethenorth12/test-fresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 978a97770aada576052d6e62b4a5815fb8a186b1b30275860c0951f00f5b3f7c On require of the package, index.js collects the machine hostname, OS username, package name, and a timestamp and sends them via HTTPS GET to a...

Malicious code in @wethenorth12/test-fresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 978a97770aada576052d6e62b4a5815fb8a186b1b30275860c0951f00f5b3f7c On require of the package, index.js collects the machine hostname, OS username, package name, and a timestamp and sends them via HTTPS GET to a...

Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12038 Malicious code in bigops-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a The package's main entry requires ./ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a The package's main entry requires ./ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

SUSE CVE-2026-9499

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

SUSE CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

SUSE CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

PT-2026-68127

Name of the Vulnerable Software and Affected Versions @oblique/cli version 15.4.0 Description An OS command injection issue exists in the project creation functionality. The application constructs shell commands using string concatenation and executes them via the execSync function. Because the...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

PT-2026-68365

Name of the Vulnerable Software and Affected Versions Rongzhitong Visual Integrated Command and Dispatch Platform versions prior to 20260617 Description A SQL injection flaw exists that allows remote attackers to execute unauthorized database queries. The issue occurs within an unknown function o...

PT-2026-68109

Name of the Vulnerable Software and Affected Versions backmeup affected versions not specified Description The backmeup npm package is susceptible to OS command injection because it constructs shell command strings by directly concatenating option values instead of using an argument array with...

CVE-2026-48168: Missing Authorization

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...

PT-2026-68276

Name of the Vulnerable Software and Affected Versions Jenkins Summary Display Plugin versions 1.15 and earlier Description Stored cross-site scripting XSS occurs in build report pages because the job name is not properly escaped within a JavaScript context. This issue can be exploited by users...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

CVE-2026-70441: Improper Neutralization of Input During Web Page Generation

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

PT-2026-68115

Name of the Vulnerable Software and Affected Versions 299Ko affected versions not specified Description An unauthenticated attacker can perform a reflected Cross-Site Scripting XSS attack via the public contact form. The issue occurs because the home function in...