GO-2026-6734 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI...

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

CVE-2026-107805

The Nginx UI web user interface is vulnerable to a resource exhaustion flaw in versions 2.5.0 through 2.6.0 . The root cause lies in the node-signature authentication path , which stages an attacker-controlled request body into a temporary file and synchronizes it before validating the cryptograp...

CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-71415: Missing Authorization

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

Malicious code in dolyame-ui-iconloaderhoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcod...

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

MAL-2026-12852 Malicious code in bigops-umf-statist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45 index.js requires./bootstrap.js on load. bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of...

Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...

MAL-2026-12933 Malicious code in bnpl-blocks-desktop-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c8c28332f033f4a53e19a9c2555f07d05be868631e953e2c3156b50ed2e397 On require, index.js loads shim.js which reconstructs C2 hostnames from split string arrays Cloudflare Workers subdomains...

MAL-2026-12932 Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12956 Malicious code in bnpl-blocks-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeff40a463b598ac2764623ad9820714953bbb4a882848e4a2d68d1ec0a74fd On require of the package, index.js loads./bridge.js which reconstructs attacker-controlled hostnames from split string fragments...