MAL-2026-760 Malicious code in @helloflex/widget-next-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ca9fce3cc7390ed9fa54426eb0404651c2679a146b83aaf537d0d4c4cf9ba2c The package @helloflex/widget-next-sdk was found to contain malicious code. Source: ghsa-malware...

Oracle Enterprise Manager Cloud Control (January 2026 CPU)

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent...

Fedora: Security Advisory (FEDORA-2026-b31c8d8e83)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2026-d8979b7a9c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OSV-2026-170 Use-of-uninitialized-value in pcpp::PcapNgFileReaderDevice::getNextPacketInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479882050 Crash type: Use-of-uninitialized-value Crash state: pcpp::PcapNgFileReaderDevice::getNextPacketInternal pcpp::IFileReaderDevice::getNextPackets FuzzWriter.cpp...

[SECURITY] Fedora 43 Update: bind9-next-9.21.17-1.fc43

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Fedora 43 : bind9-next (2026-b31c8d8e83)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b31c8d8e83 advisory. Update to 9.21.17 rhbz2415843 Security Fixes: - Fix incorrect length checks for BRID and HHIT records. CVE-2025-13878 New Features: - Add support for Extende...

Fedora 42 : bind9-next (2026-d8979b7a9c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d8979b7a9c advisory. Update to 9.21.17 rhbz2415843 Security Fixes: - Fix incorrect length checks for BRID and HHIT records. CVE-2025-13878 New Features: - Add support for Extende...

CVE-2025-13984

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

EUVD-2025-206437

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

CVE-2025-13984

The Drupal Next.js module (specifically SA-CONTRIB-2025-122 ) contains a permissive cross-domain security policy that enables Cross-Origin Resource Sharing (CORS) with insecure default settings (Access-Control-Allow-Origin: ps *). This behavior overrides any services.yml CORS configuration, allow...

CVE-2025-13984 Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

9remote (>=0.1.0, <=0.1.8), @acvtech5b9/vms-multi-language-locals (100.0.0) +119 more potentially affected by unknown CVE via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864. A specially crafted HTTP...

9remote (>=0.1.0, <=0.1.8), @acvtech5b9/vms-multi-language-locals (100.0.0) +119 more potentially affected by CVE-2026-23864 via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.4.0 and more Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

@vitnode/blog (>=1.2.0-canary.56, <=1.2.0-canary.59) potentially affected by CVE-2026-23864 via next (15.6.0-canary.41)

next NPM version 15.6.0-canary.41 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @vitnode/blog =1.2.0-canary.56, =1.2.0-canary.59 Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2026-23864 via next (>=15.2.0-canary.64, <=15.2.8)

next NPM version =15.2.0-canary.64, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2026-23864...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +205 more potentially affected by CVE-2026-23864 via next (>=16.0.0-beta.0, <=16.0.10)

next NPM version =16.0.0-beta.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4556 and more Source cves: CVE-2026-23864 Source advisory: GHSA-H25M-26QC-WCJF...

@risc0/ui (>=0.0.314, <=0.0.315) potentially affected by CVE-2025-59472 via next (15.2.2-canary.0)

next NPM version 15.2.2-canary.0 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @risc0/ui =0.0.314, =0.0.315 Source cves: CVE-2025-59472 Source advisory: OSV:GHSA-5F7Q-JPQC-WP7H...

@lightdotso/ai (>=0.0.1, <=0.0.18), @lightdotso/app (>=3.2.7, <=3.2.23) +35 more potentially affected by CVE-2025-59472 via next (>=15.0.0-canary.2, <=15.0.0-canary.196)

next NPM version =15.0.0-canary.2, =0.0.1, =3.2.7, =0.0.2, =3.1.4, =0.0.2, =3.1.7, =0.0.7, =3.2.7, =3.1.6, =3.0.7, =0.0.2, =0.0.7, =0.0.6, =3.1.4, =0.0.8, =0.0.21 and more Source cves: CVE-2025-59472 Source advisory: GHSA-5F7Q-JPQC-WP7H...