MAL-2026-13403 Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

CVE-2026-19035

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-69185

A flaw was found in Socket.IO. A remote attacker could send a specially crafted packet that causes the server to buffer a large number of binary attachments. This can lead to the server running out of memory, resulting in a denial of service DoS...

CVE-2026-67305

The FreeRDP Windows client contains a heap buffer overflow vulnerability. If a user pastes maliciously crafted, oversized clipboard data from an untrusted RDP server, it triggers memory corruption that may result in remote code execution...

libXfont2: computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server...

CVE-2026-68579

A flaw was found in FreeRDP. A heap-based buffer overflow exists in the Windows clipboard client's CliprdrStreamRead function. A malicious or compromised Remote Desktop Protocol RDP server can send an oversized clipboard file contents response. When a user pastes this content, it causes an...

CVE-2026-19036

Shibby Tomato CVE-2026-19036 affects the wanoptions component: the function sub_40F88C in /tmp/ppp/wanoptions is vulnerable when processing the ppp_custom argument, enabling OS command injection. The issue can be triggered remotely, and public exploits exist. The affected product/version is Shibb...

CVE-2026-19036 Shibby Tomato wanoptions sub_40F88C os command injection

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument pppcustom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may...

CVE-2026-19035

CVE-2026-19035 affects Shibby Tomato 1.28.0000. The flaw is in the function new_qoslimit_start in /etc/qoslimit, where manipulating the argument new_qoslimit_enable enables OS command injection. Remote exploitation is possible and the exploit is publicly available; CVSS metrics indicate HIGH impa...

EUVD-2026-53867

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-66909

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-19034

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-64194

A flaw was found in Net::DNS. A remote attacker can exploit this vulnerability by sending a specially crafted DNS packet with deep compression pointer chains. This can cause excessive recursion in the Net::DNS::DomainName::decode function, leading to stack exhaustion and a Denial of Service DoS f...

EUVD-2026-53844

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19034

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19034

CVE-2026-19034 affects Shibby Tomato 1.28.0000. The vulnerability lies in the function new_qoslimit_stop in the file /tmp/qoslimittc_stop.sh; manipulating the argument wan_iface can lead to an OS command injection. The attack is remote, and the exploit has been publicly disclosed. The issue is ti...

EUVD-2026-53854

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909

Summary: CVE-2026-66909 affects Apache CXF's JMS transport, where inbound JMS ObjectMessage bodies are deserialized with no type restrictions, enabling potential denial of service or remote code execution if a gadget class is present on the classpath. The root cause is unrestricted native Java de...