MAL-2026-14926 Malicious code in 3layerdipstackta7o8u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4480e6c9524da41aefdf35dffa4ec2b4a5911f6902b5ebe1b98c8e276426cb1b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14976 Malicious code in 3layerdipstackwudpnc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7fc4a9473451d1aa67c931cf613fea7d1d733fee91bc3858a9ff6de651c4ace The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14891 Malicious code in 3layerdipstackqjq77e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f320682123c83343a81c91e396664d2bd5a949a41ce07bffc822f83502648979 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14962 Malicious code in 3layerdipstackvkl1hd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b377c7fe1096a29a14d5b88a8976bffe545ab4fae10c8833cc53fd72c2f9a1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14850 Malicious code in 3layerdipstacknwgnpw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fef015b83fdf77a773800ffc095c94b5b0aab174eafca3c68e158cca40f9c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14885 Malicious code in 3layerdipstackq4ek0f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d889748f378b114bb74220ed9ecf1dfbf2548c5126539fe997b409e201c4b23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackryyay3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873039b8de9adf03f5e9bca4a4d16a82152226c59aaab549d11a578d084b5d57 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack5dfkei (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1b3c3d64b475cec5c69322b31b3e3bd9cba689f87cb9f878acde15f8dc7e8e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack9gdxi6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa3f122cca9a4975d91aefb7515d935f02e2e69115a54f9576be92972272f656 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

WordPress Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates plugin < 3.7.1 - Unauthenticated API Secret Disclosure vulnerability

Unauthenticated API Secret Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WPLegalPages versions 3.7.1...

AZL-98310 CVE-2026-42393 affecting package dovecot 2.3.20-1

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

ALPINE-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

MAL-2026-14586 Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

CVE-2026-61783

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

UBUNTU-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

PT-2026-83069

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...