Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

PYSEC-2026-3615 QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

ImpactThe relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11113 – SMTP Header Injection in Contact Form...

RUSTSEC-2026-0237 `nostr-relay-builder` is unmaintained

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

RUSTSEC-2026-0243 `nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

`nostr-relay-builder` is unmaintained

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

`nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

PT-2026-76523

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

PT-2026-76517

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

Fedora 43 : nsd (2026-0b77a23312)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0b77a23312 advisory. FEATURES: Merge 483 from ruuda: Improve Prometheus metrics: Move zonestats from metric name to label BUG FIXES: Fix 478: Feature request: reduce...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0225...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0227...

Processing of unverified relay events

The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be skipped. The verification cache also...

Relay authentication challenges can exhaust memory

The SDK forwarded every NIP-42 AUTH challenge received from a relay through an unbounded command queue. Challenge handling can wait for an asynchronous signer or user interaction, so receiving challenges was substantially faster than completing the corresponding authentication work. A malicious...

Verification cache poisoning allows forged Nostr events to bypass signature validation

The nostr-relay-pool crate cached the result of event signature verification before the check was actually performed. Because the entry was inserted unconditionally, a first delivery whose signature failed was still recorded in the cache. A subsequent delivery of the same event identical ID, but...

SMTP Open Relay

Tests whether an SMTP server accepts third-party relay MAIL FROM / RCPT TO to external domains without completing DATA NSE smtp-open-relay. !/usr/bin/env python3 -- coding: utf-8 -- """SMTP open relay check NSE smtp-open-relay.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient...

FreeBSD : Weechat -- Multiple vulnerabilities (0d5b4884-8c2b-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0d5b4884-8c2b-11f1-8144-8447094a420f advisory. The Weechat project reports: Use-after-free and double free when a remote relay sends an event with an...