Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the irc.sendTo header and other irc. headers in HTTP requests. An attacker can redirect outgoing IRC messages to arbitrary channels or users by injecting...

Malicious code in zod-pino434 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599a5d533bf699156b78f5296f643227bf3e43d8e46f2adabfe250205a05bd26 Package name zod-pino434 and package.json description Node.js integration layer for Autodesk Forge do not match the shipped code. On npm install, the...

Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...

MAL-2026-6795 Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...

FreeBSD : Weechat -- Memory leak in relay-API (d7939352-788b-11f1-b72c-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d7939352-788b-11f1-b72c-8447094a420f advisory. The Weechat project reports: Pre-auth memory leak in relay-api POST /api/handshake unfreed JSON body...

PT-2026-55904

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An injection issue exists in the Apache Camel IRC component due to improper input validation and...

Weechat -- Memory leak in relay-API

The Weechat project reports: Pre-auth memory leak in relay-api POST /api/handshake unfreed JSON body → unauthenticated remote memory-exhaustion DoS...

SIPROTEC Relay Protection Random Values

The vulnerability of SIPROTEC 5 relay protection, automation, and control devices is related to the limited number of possible random values. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to the protected information...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) vulnerability

Missing Authorization to Unauthenticated Arbitrary Email Content Injection Mail Relay / Phishing vulnerability discovered by ? in WordPress Plugin Kirki versions = 6.0.11...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storagesync, cert-manager, crossplane-provider-azure-servicebus, gobuster, crossplane-provider-azure-synapse, splunk-otel-collector-fips, nfpm, crossplane-provider-azure-orbital, commercial-grafana, crossplane-provider-azure-web,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-guardduty, hcloud, kueue-fips, sealed-secrets, crossplane-provider-aws-acm-fips, trivy-operator, zarf, crossplane-provider-aws-opensearch-fips, crossplane-provider-aws-route53resolver-fips, nerdctl, kube-conformance, prometheus-mongodb-exporte...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-guardduty, hcloud, kueue-fips, sealed-secrets, crossplane-provider-aws-acm-fips, trivy-operator, zarf, crossplane-provider-aws-opensearch-fips, crossplane-provider-aws-route53resolver-fips, nerdctl, kube-conformance, prometheus-mongodb-exporte...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider, hcloud, buildkitd, trivy-operator, tekton-pipelines, nfpm, zarf, containerd, step, rancher-agent, commercial-expanso-edge, scorecard, age, nerdctl, kube-conformance, kuma, prometheus-mongodb-exporter, crossplane-provider-azure-powerbidedicate...

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent...

MAL-2026-6518 Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

PT-2026-56109

Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent...

EUVD-2026-39219

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrackirc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given...

Schneider Electric PowerLogic P7 Relay Pointer Assignment Error DoS

The vulnerability of the microprogramming software of Schneider Electric PowerLogic P7 relay protection devices relates to pointer assignment errors. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Schneider Electric PowerLogic P7 Relay Execution Arbitrary Commands

The vulnerability of the microprogramming software of Schneider Electric PowerLogic P7 relay protection devices relates to the lack of measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...