Low: firefox

Issue Overview: libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Affected Packages: firefox Note: This advisory is applicable to Amazon Linux 2 - Firefox Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extra...

Perl security vulnerabilities

Perl is a general-purpose, interpreted, dynamic, cross-platform programming language from the Perl community. Versions of Perl 5.43.10 and earlier contain security vulnerabilities. These vulnerabilities stem from a heap buffer overflow vulnerability that occurs when compiling regular expressions...

TencentOS Server 3: firefox (TSSA-2026:0397)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0397 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-45438 WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0...

CVE-2026-48837

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8...

CVE-2026-27398

The CVE-2026-27398 entry describes a Missing Authorization vulnerability in the WordPress RSVP and Event Management plugin, affecting versions up to 2.7.16. The issue is classified as a Broken Access Control vulnerability with insecure access configuration allowing exploitation without user inter...

CVE-2026-27346

The CVE concerns WordPress plugin B2BKing (pre-5.2.10). A Missing Authorization/Broken Access Control vulnerability arises from incorrectly configured access control/security levels, allowing improper access within the B2BKing plugin. Affected versions are before 5.2.10. The CVSS metrics indicate...

EUVD-2026-31746

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3...

Malicious code in verify-mycommand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f94ffb54a2471d0cc94ce1ea88f741e034221a374f17bfadbd609cb22f14f24 On npm install, postinstall.js executes whoami and id, collects host identity hostname, platform, cwd and CI metadata CI, GITHUBREPOSITORY, NODEENV...

CVE-2018-25378 Notebook Pro 2.0 Denial of Service via Notebook Name Field

Notebook Pro 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the notebook name field. Attackers can create a malicious text file containing 500 or more characters, paste the content into the New Noteboo...

SUSE-SU-2026:2049-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled...

MAL-2026-4347 Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - React2shell A Python 2.7 exploit for CVE-2...

CVE-2026-9435

creationtimestamp| type| source ---|---|--- 2026-05-25 10:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116634748548269306 2026-05-25 10:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmobiyztm622 2026-06-22 03:46:46+00:00| seen|...

SUSE-SU-2026:21831-1 Security update for libarchive

This update for libarchive fixes the following issues - CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS bsc1259635. - CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 bsc1259928. - CVE-2026-4426:...

SUSE-SU-2026:21757-1 Security update for libarchive

This update for libarchive fixes the following issues - CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS bsc1259635. - CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 bsc1259928. - CVE-2026-4426:...

CVE-2026-9434

creationtimestamp| type| source ---|---|--- 2026-05-25 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116634040801870107 2026-05-25 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmnxh5ydco2l 2026-06-22 03:46:39+00:00| seen|...

CVE-2026-9489

creationtimestamp| type| source ---|---|--- 2026-05-25 06:38:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116633835396055412 2026-05-25 09:26:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116634495611199490...

CVE-2026-9407

creationtimestamp| type| source ---|---|--- 2026-05-25 03:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116632979036479792 2026-05-25 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmniedcwxa26 2026-06-22 03:17:08+00:00| seen|...

CVE-2026-45409

creationtimestamp| type| source ---|---|--- 2026-05-25 02:03:41+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mmnf6taznj27 2026-05-25 03:04:26+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mmnil4kweh2v 2026-05-26 00:02:50+00:00| seen|...