MAL-2026-17743 Malicious code in tailwind-animatecss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af43d6ea5b41804fed5e67e2de300fceed98d4f487c0e9675aabcfe457e87e3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-108109

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-104082

SmarterMail before Build 9777 is vulnerable to Remote Code Execution (RCE) due to a bypass of the Volume Mount script-directory containment control . An attacker with a SysAdmin-scoped access token can provision a new mail domain via the domain-put endpoint, setting an arbitrary FileStore root pa...

CVE-2026-104082 SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...

EUVD-2026-95887

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...

MAL-2026-17731 Malicious code in @aseppxyzz12/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0c3a4c58c42cbe1dc7135a6b4ff75cf3242ba4b65463994ff78cdec19f53698 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in asepxyznew

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-108109

PHPNuxBill versions through 2025.3.20 are vulnerable to an account takeover due to a flaw in the customer password reset flow within system/controllers/forgot.php. The vulnerability allows unauthenticated attackers who know a customer's username to brute-force a 6-digit otp_code because the syste...

EUVD-2026-95810

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otpcode. Attackers knowing a customer username can guess the code without attempt limits or...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

Security Bulletin: Multiple vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were found in linux kernel, libssh expat, libssh, openSSL in Platform System Manager PSM OS Image for Red Hat Enterprise Linux v8 shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

USN-8911-1 linux-oem-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - USB core drivers; -...

USN-8911-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - USB core drivers; -...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

BIT-GHOST-2026-103286 Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated...

CVE-2026-94668

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...

CVE-2026-94668 WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...