CVE-2026-63000

The REDAXO PHP-based content management system is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 5.21.2 . The rex_api_install_package_update function in redaxo/src/addons/install/lib/api/api_package_update.php fails to override the requiresCsrfProtection() method, w...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

ROOT-APP-NPM-CVE-2026-59940 CVE-2026-59940 in seroval - Patched by Root

Root has patched CVE-2026-59940 in the seroval package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42198 CVE-2026-42198 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2026-42198 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...

EUVD-2026-85161

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

MAL-2026-16455 Malicious code in some-tool-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in some-tool-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CLEANSTART-2026-QV01130 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

SUSE CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

MAL-2026-16475 Malicious code in memoryos (PyPI)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

CVE-2026-63000: Cross-Site Request Forgery (CSRF)

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16404 Malicious code in sysverify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edfe23ae0c8a79c155c23e410616585061296886bb752d734feb1b2180ffc82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview mxdriver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview epic-consent-dialog is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...