MAL-2026-14544 Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

CVE-2026-73501

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

jQuery-Checker-Multiple-XSS-Vulnerabilities

jQuery CVE-2020-11022 · CVE-2020-11023 — checker scanner...

CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-47837

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

GHSA-7W8C-QGXG-M7JX LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device via compromised SNMP agent or syslog sender can inject arbitrary JavaScript that executes when any...

EUVD-2026-66642

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-58474

whichllm before version 0.5.16 contains a code injection vulnerability in the run and snippet commands. The script generation function in cli.py interpolates HuggingFace-derived values—including GGUF variant filenames from the Hub API siblings rfilename field—directly into Python source code with...

CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-80529

A flaw was found in the Linux kernel's XFS filesystem. During dquot recovery, the xlogrecoverdquotcommitpass2 function fails to correctly propagate verification errors. This allows a corrupt quota buffer to be written back to disk, potentially leading to data corruption within the XFS filesystem...

CVE-2026-80533

A flaw was found in the Linux kernel's XFS filesystem. This vulnerability occurs during the Allocation Group Information AGI repair process, specifically in the xrepiunlinkwalkondiskbucket function. If the buffer verifier fails, a null pointer dereference can occur when attempting to rebuild...

CVE-2026-80532

A flaw was found in the XFS filesystem's online file system check fsck utility within the Linux kernel. The xrepiunlinkresolvebucket function, responsible for reconstructing unlinked inode lists, is vulnerable to an infinite loop. This can occur due to malformed nextunlinked pointers, potentially...

CVE-2026-80534

A flaw was found in the XFS filesystem component of the Linux kernel. The xfsdqgetnextid function fails to release an inode lock ilock if an error occurs during extent reading. This ilock leak can leave the quota inode permanently locked, preventing further quota operations and leading to a denia...

EUVD-2026-66638

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837

Spring Cloud Config Server is vulnerable to Missing Authentication for Critical Function via its /monitor endpoint, which does not validate incoming webhook requests. An attacker can trigger unauthorized actions or cause unintended effects by sending crafted webhook requests to this endpoint. Aff...