PT-2026-93373

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.1 Description A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the ds create dnskey digest...

Linux Distros Unpatched Vulnerability : CVE-2026-81642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code...

EUVD-2026-78070

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

CVE-2026-53713

Envoy Gateway (an open-source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway) has an authentication bypass in its Lua validator. Prior to versions 1.7.4 and 1.8.1 , the to_absolute_normalized_path function in internal/gatewayapi/luavalidator/security.lua ...

CVE-2026-53713 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

Linux Distros Unpatched Vulnerability : CVE-2026-89492

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an...

CLSA-2026-1789162879 TuxCare security update for validator (1 CVE)

TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.2...

CLSA-2026-1789161525 TuxCare security update for validator (2 CVEs)

TuxCare rebuilt validator to address 2 CVEs. Fixed in 7.2.0-tuxcare.1...

CLSA-2026-1789161501 TuxCare security update for validator (1 CVE)

TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.1...

ROOT-APP-NPM-CVE-2021-3765 CVE-2021-3765 in validator - Patched by Root

Root has patched CVE-2021-3765 in the validator package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-12758 CVE-2025-12758 in validator - Patched by Root

Root has patched CVE-2025-12758 in the validator package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-XX4C-JJ58-R7X6 GHSA-xx4c-jj58-r7x6 in validator - Patched by Root

Root has patched GHSA-xx4c-jj58-r7x6 in the validator package for Root:npm. Multiple fixed versions available...

PT-2026-96067

Root has patched GHSA-xx4c-jj58-r7x6 in the validator package for Root:npm. Multiple fixed versions available...

PT-2026-96631

TuxCare rebuilt validator to address 2 CVEs. Fixed in 7.2.0-tuxcare.1...

PT-2026-96632

TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.2...

PT-2026-96630

TuxCare rebuilt validator to address 1 CVE. Fixed in 4.4.0-tuxcare.1...

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summarypiccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET.The sessions table stores live session tokens in plaintext, and the token column is not marked...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

Malicious Package

Overview polygon-toolkits-validator is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...