MAL-2026-6506 Malicious code in pump-laserstream-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92a36ce6afdf46f9c63d665ee85ca989b2678feb83e79ff3969c2fb5d1328475 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6490 Malicious code in data-parser-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fb4c4230fa7663c13b273922ecdf6dad55a30791d1332067841ec011814e5b8 index.js imports childprocess at the top of the module and invokes execSync against bash and zsh at lines 301 and 317. The shape —...

Malicious code in data-parser-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fb4c4230fa7663c13b273922ecdf6dad55a30791d1332067841ec011814e5b8 index.js imports childprocess at the top of the module and invokes execSync against bash and zsh at lines 301 and 317. The shape —...

CVE-2026-30041

CVE-2026-30041 affects FastStone Image Viewer v8.3 and earlier, due to an integer overflow in the PSD parser component caused by invalid height handling, which leads to a heap-based buffer overflow. Exploitation with a crafted PSD file could allow arbitrary code execution or cause a DoS. Public s...

SUSE SLES16 Security Update : perl-HTML-Parser (SUSE-SU-2026:22189-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22189-1 advisory. This update for perl-HTML-Parser fixes the following issue - CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap...

SUSE SLES16 Security Update : libyang (SUSE-SU-2026:22208-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22208-1 advisory. This update for libyang fixes the following issues - CVE-2026-41401: use-after-free in lydparsersetdataflags when processing craft...

kernel: rxrpc: fix RESPONSE authenticator parser OOB read

A flaw was found in the Linux kernel's rxrpc subsystem. A remote attacker could send a specially crafted rxrpc RESPONSE authenticator that, due to an incorrect parser limit calculation in the rxgkverifyauthenticator function, leads to a slab-out-of-bounds read. This memory corruption vulnerabilit...

GO-2026-5456 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages in go.opentelemetry.io/obi...

CVE-2026-12975

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

CVE-2026-12975 Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

CVE-2026-12975 Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

CVE-2026-44020

A flaw was found in docling. An attacker could exploit an XML External Entity XXE vulnerability in the USPTO patent XML parser by crafting malicious XML files. This could allow the attacker to read arbitrary files from the server's filesystem, perform Server-Side Request Forgery SSRF attacks, or...

GO-2026-5349 free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf...

CVE-2026-49851

A flaw was found in Mistune, a Python Markdown parser. A remote attacker can exploit this vulnerability by providing a specially crafted Markdown input containing many consecutive bracket characters. This can lead to excessive CPU usage, causing a denial-of-service DoS condition on the affected...

MAL-2026-6469 Malicious code in ts-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d2534408d7dd1d7f02c3ef470bc697d0803e8acd58941de5974a250127cb8c Package ships a verbatim copy of big.js v7.0.1 including the original author metadata 'Michael Mclaughlin ' and repo reference MikeMcl/big.js under a...

Malicious code in ts-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d2534408d7dd1d7f02c3ef470bc697d0803e8acd58941de5974a250127cb8c Package ships a verbatim copy of big.js v7.0.1 including the original author metadata 'Michael Mclaughlin ' and repo reference MikeMcl/big.js under a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parser process. An attacker can cause excessive memory consumption by submitting a specially crafted Helm chart archive that decompresses to a very large size. Remediation...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parser process. An attacker can cause excessive memory consumption by submitting a specially crafted Helm chart archive that decompresses to a very large size. Remediation...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parser process. An attacker can cause excessive memory consumption by submitting a specially crafted Helm chart archive that decompresses to a very large size. Remediation...

ALPINE-CVE-2026-56123

socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read...