520705 matches found
Malicious code in @array-util/nodepull (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...
MAL-2026-6084 Malicious code in @array-util/nodepull (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcafb3a6336948fd12673cfe88d505e2a036afcfb5e9ee5d4b850cf982753d9b @array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require/import, the IIFE silences process error handlers vi...
[slackware-security] openssl
New openssl packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1zh-i586-1slack15.0.txz: Upgraded. Apply patch to fix the following security issues: Heap Buffer Over-read in ASN.1 Conte...
Malicious code in pino-slite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea546461f3101a972511a0bb9d66b73849904ad3522724d1670b003e108c11bb pino-slite impersonates the legitimate pino logger README titled 'pino-slite Pino' with badges and homepage pointing to getpino.io, exported function...
MAL-2026-6078 Malicious code in pino-slite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea546461f3101a972511a0bb9d66b73849904ad3522724d1670b003e108c11bb pino-slite impersonates the legitimate pino logger README titled 'pino-slite Pino' with badges and homepage pointing to getpino.io, exported function...
GHSA-7P36-FQ2R-4H7R Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
Security Bulletin: Vulnerable Version of Software in Use
Summary Vulnerable version of glibc included in prior versions of product. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character...
Security Bulletin: Vulnerable Version of Software in Use
Summary Vulnerable version of glibc in prior versions of product. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which...
CVE-2026-55202
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger...
CVE-2026-55201
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...
CVE-2026-12529
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote...
CVE-2026-11407
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
EUVD-2026-37795
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
CVE-2026-11407
PIMCORE CMS/DXP 12.3.8 contains a sandbox bypass in the Twig SecurityPolicy (checkMethodAllowed and checkPropertyAllowed). Authenticated administrative attackers can craft malicious Twig templates via DataObject ClassDefinition Layout\Text to execute arbitrary PHP object methods, perform file rea...
CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
CVE-2026-53871
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the getprofilecookie function that accepts unauthenticated profile names from the hermesprofile cookie. An authenticated attacker can forge the hermesprofile cookie value to bypass profile-scoped authorization checks a...
CVE-2026-55202 Tinyproxy - Stathost Detection Bypass via Host Header Manipulation
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger...
EUVD-2026-37786
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger...