CVE-2026-10672

CVE-2026-10672 affects Zephyr LwM2M firmware Update pull: a memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN) into a 128-byte buffer, with no length validation, copies up to 128 bytes of a server URI and omits the NUL terminator. Subsequent strlen and CoAP/PROXY_URI parsing read past the end into a...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: actions-runner, kibana, lerna, opensearch-dashboards, npm, pulumi, saf, sqlpad, code-server, kubeflow-centraldashboard, wazuh-dashboard, prism, gitlab-rails-ce-fips, opensearch-dashboards-fips, graalvm, gitlab-rails-ce, wazuh-dashboard-fips...

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: actions-runner, kibana, lerna, opensearch-dashboards, npm, pulumi, saf, homepage, sqlpad, code-server, kubeflow-centraldashboard, wazuh-dashboard, prism, gitlab-rails-ce-fips, opensearch-dashboards-fips, graalvm, gitlab-rails-ce, wazuh-dashboard-fips...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: actions-runner, kibana, lerna, opensearch-dashboards, npm, pulumi, saf, homepage, sqlpad, code-server, kubeflow-centraldashboard, wazuh-dashboard, prism, gitlab-rails-ce-fips, opensearch-dashboards-fips, graalvm, gitlab-rails-ce, wazuh-dashboard-fips...

GHSA-GF2W-JQMQ-FCM8 vulnerabilities

Vulnerabilities for packages: python...

GHSA-9MC4-RQMQ-H467 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: npm, sqlpad, prism, pulumi, code-server, kubeflow-centraldashboard, lerna, saf...

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: npm, sqlpad, prism, pulumi, code-server, kubeflow-centraldashboard, lerna, saf...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: npm, sqlpad, prism, pulumi, code-server, kubeflow-centraldashboard, lerna, saf...

GHSA-3CFQ-4XX4-RMPG vulnerabilities

Vulnerabilities for packages: libssh2...

CVE-2026-55199 vulnerabilities

Vulnerabilities for packages: libssh2...

Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10595 Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in async-mutex-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...

MAL-2026-10582 Malicious code in async-mutex-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10587 Malicious code in dayjscore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...

MAL-2026-10584 Malicious code in chalkdevx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...