46737 matches found
Malicious code in discord-mfa-solver (npm)
Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require of the declared dependency node-net-pool ^1.0.0 in...
Malicious code in mfatest2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...
MAL-2026-16102 Malicious code in mfatest2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...
Malicious code in discord-mfa-solver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...
MAL-2026-16100 Malicious code in discord-mfa-solver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...
RLSA-2026:65534 Important: image-builder security update
A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Certificat...
net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
GHSA-2J8R-3C22-8565 Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
Heap-based Buffer Overflow
Overview Microsoft.DiaSymReader.Native is a Native implementation of PDB file reader and writer. Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the processing of PDB files. An attacker can perform an out-of-bounds write and cause unintended behavior by supplying...
GHSA-527H-Q9F6-P7QX Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
EUVD-2026-73720
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability...
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
GHSA-63GH-G2X5-X69V Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...
OPENSUSE-SU-2026:21824-1 Security update for containerized-data-importer1.65
This update for containerized-data-importer1.65 fixes the following issues: - CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239322. - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs bsc1238699. - CVE-2025-22872: golang.org/x/net/html...