MAL-2026-15092 Malicious code in classlink-idih6eh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e51eaef373af0dded182557c5e52ee70eb0f184aea4cbb11baf37c08a9530c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-0xj51osu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa19dd4b785b4e5c10541c82200044c0724174b40816a0d2f990c7dd1c09ea04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-idih6eh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e51eaef373af0dded182557c5e52ee70eb0f184aea4cbb11baf37c08a9530c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-tbq8gn8g (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87dd283be1677692bf35446cea3a62ed1fbb36f17a8242c49d832b26fdc81bf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-d6dllzf9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3a69453d0c9becd3e689a6da1b15e65487491038bff4e6a66f359c7c0fe93ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15056 Malicious code in classlink-co3ghhbr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 012ebab64d413e843b2fb7e2be2353a65fb81d8ab6e0dfb0cae7f8191db96925 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-80691

CVE-2026-80691 is a NULL pointer dereference in the Linux kernel SCSI target iblock subsystem . In iblock_execute_pr_out(), the PRO_PREEMPT , PRO_PREEMPT_AND_ABORT , and PRO_RELEASE operations perform capability checks through ops->pr_clear; the flawed check allows unimplemented hooks to pass,...

WS-2026-0037

The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an...

Linux Distros Unpatched Vulnerability : CVE-2026-19538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TL...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

NethServer WebTop 1.5.6 Cross Site Scripting

NethServer WebTop module versions 1.5.6 and below suffer from two persistent cross site scripting vulnerabilities...

SPA: Securing Persistent LLM Agents across Queries with Plan-First Information-Flow Control

Large language model LLM agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources. Existing defenses typically protect either planning or individual tool interactions, but persistent agents face a...

CVE-2025-62343: Undefined Security Weakness

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

EUVD-2026-66560

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548

kas is a setup tool for bitbake-based projects. Prior to version 5.4 , when internal SSH key setup is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no user-specific SSH configuration exists, the function ssh_no_host_key_check() in kas/libcmds.py creates ~/.ssh/config with a global Hos...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-19538

A flaw was found in nsd. A remote attacker can bypass BLOCKED access control list ACL items on the proxy protocol port. This bypass occurs when connecting over TCP or TLS and sending the query twice on a persistent connection. This could allow unauthorized access or actions that should have been...

CVE-2026-80182

A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can...