CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

CVE-2026-49420

The RTSP handler in FreeBSD's libalias library writes rewritten packets into a fixed-length stack buffer without bounds checks, enabling a stack buffer overflow triggered by crafted RTSP traffic on NAT ports 554/7070, leading to RCE in the kernel (ipfw(4) NAT) or root-owned natd(8) process. Worka...

CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

CVE-2026-76038

creationtimestamp| type| source ---|---|--- 2026-08-19 04:47:33+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260819 2026-08-24 04:46:26+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260824 2026-08-24...

CVE-2026-74988

creationtimestamp| type| source ---|---|--- 2026-08-19 04:47:12+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 18:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjucv2vtg25...

CVE-2026-74986

creationtimestamp| type| source ---|---|--- 2026-08-19 04:47:07+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjuctplmh24...

CVE-2026-74984

creationtimestamp| type| source ---|---|--- 2026-08-19 04:47:03+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...

CVE-2026-74981

creationtimestamp| type| source ---|---|--- 2026-08-19 04:46:56+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...

CVE-2026-74975

creationtimestamp| type| source ---|---|--- 2026-08-19 04:46:42+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-25 16:01:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mtw6w2lyvv2e...

CVE-2026-74971

creationtimestamp| type| source ---|---|--- 2026-08-19 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...

CVE-2026-74968

creationtimestamp| type| source ---|---|--- 2026-08-19 04:46:26+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...

CVE-2026-74949

creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:42+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtix3ozgqv22...

CVE-2026-74936

creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:12+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 21:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtk5sspqbr25...

CVE-2026-70408

creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:05+00:00| seen| https://jvn.jp/en/jp/JVN47716829 2026-08-19 05:53:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/drxjlkjzlugcu 2026-08-19 06:00:23+00:00| seen|...

EUVD-2026-62230

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

Malicious code in npm-wold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...

Malicious code in ambera (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...