Malicious Package

Overview alpha-replicator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1188 Malicious code in alpha-replicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 813b40640376929ec6b2c1eac05da3cf3248e3ad74ea5f28ec2c6770a81b039d The package alpha-replicator was found to contain malicious code. Source: ghsa-malware 2a31df37c5505c0c72366c3a25757305201aa2db41da2a774157074244006a...

CVE-2026-3282

A flaw was found in libvips. A local attacker can exploit this vulnerability by manipulating the alphaband argument in the vipsunpremultiplybuild function, leading to an out-of-bounds read. This can potentially disclose sensitive information...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the vipsunpremultiplybuild function in the file unpremultiply.c when processing the alphaband argument. An attacker can access sensitive information by triggering an out-of-bounds read through local manipulation o...

CVE-2026-3282

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vipsunpremultiplybuild of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alphaband can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

CVE-2026-3282 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vipsunpremultiplybuild of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alphaband can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

CVE-2026-3282 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vipsunpremultiplybuild of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alphaband can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

CVE-2026-3282

The CVE-2026-3282 entry affects libvips 8.19.0, specifically the vips_unpremultiply_build function in libvips/conversion/unpremultiply.c. The vulnerability arises when manipulating the alpha_band argument, which can cause an out-of-bounds read. Exploitation is described as local, and multiple sou...

CVE-2026-3282

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vipsunpremultiplybuild of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alphaband can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

PT-2026-22286

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips unpremultiply build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha band can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has be...

libvips 缓冲区错误漏洞

libvips is an open-source fast image processing library with low memory requirements. Version 8.19.0 of libvips contains a buffer error vulnerability. This vulnerability stems from incorrect handling of the parameter alphaband in the function vipsunpremultiplybuild found in the file...

CVE-2026-27822

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting XSS vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an...

CVE-2026-27608

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by...

EUVD-2026-8590

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover...

Improper Validation of Unsafe Equivalence in Input

Overview parse-dashboard is a The Parse Dashboard for Parse Server Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the ConfigKeyCache process. An attacker can obtain unauthorized access to sensitive master key information by exploiting cac...

EUVD-2026-8592

Parse Dashboard is Missing CSRF Protection for its Agent Endpoint...

CVE-2026-27822

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting XSS vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an...

CVE-2026-27609

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submit...

CVE-2026-27610

In Parse Dashboard, versions 7.3.0-alpha.42 through 9.0.0-alpha.7 have a vulnerability where the ConfigKeyCache uses the same cache key for both the master key and the read-only master key when resolving function-typed keys. Under specific timing conditions, this can allow a read-only user to obt...

CVE-2026-27608

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by...