CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2026-25492

Craft CMS versions 3.5.0–4.16.17 and 5.0.0-RC1–5.8.21 are affected. The save_images_Asset GraphQL mutation can be abused to fetch internal URLs by supplying a domain resolving to an internal IP, bypassing hostname validation. If a non-image file extension (e.g., .txt) is allowed, downstream image...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

Malicious code in adobe_pipeline_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e438937c9c04fd06645a505f5bd509ee3c1fa942be02cefa881023f849b781 The package adobepipelinetest was found to contain malicious code...

MAL-2026-783 Malicious code in adobe_pipeline_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e438937c9c04fd06645a505f5bd509ee3c1fa942be02cefa881023f849b781 The package adobepipelinetest was found to contain malicious code...

MAL-2026-782 Malicious code in ac-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878 [email protected] declares a preinstall lifecycle script in package.json line 7-8 that runs wget to a hardcoded webhook.site collector URL...

MAL-2026-778 Malicious code in ac-dom-nodes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b323cec1a59645d9dcb2c0951a0f7d31b362ac58e4f930306a940ed67037b20d The package ac-dom-nodes was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ac-dom-nodes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b323cec1a59645d9dcb2c0951a0f7d31b362ac58e4f930306a940ed67037b20d The package ac-dom-nodes was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ac-feature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4336ebc941f06184c39e082b6d53167ba1466dad57a4a05936446980dd4759b The package ac-feature was found to contain malicious code...

Malicious code in ac-checksum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421654f0d216d3cb6af35eb9973ccd59d6d8c7c3d8c618bf1f49343a7756aa47 The package ac-checksum was found to contain malicious code...

MAL-2026-776 Malicious code in ac-checksum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421654f0d216d3cb6af35eb9973ccd59d6d8c7c3d8c618bf1f49343a7756aa47 The package ac-checksum was found to contain malicious code...

MAL-2026-775 Malicious code in ac-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71f97348d3034afc8a89167b165172d331574fdeffd79f9392a282ff5732635f The package ac-array was found to contain malicious code...

MAL-2026-785 Malicious code in ppe-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1914d3cfcb631f551660417c0441d7e6eb3929ee6c4cadd6088e551462ead553 The package ppe-test was found to contain malicious code...

Medium: rsync

Issue Overview: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue. CVE-2025-101...

Important: python-pip

Issue Overview: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression...

Medium: golang-github-cpuguy83-go-md2man

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Medium: oci-add-hooks

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Important: golang

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 cmd/go: bypass of flag sanitization ca...

Medium: golist

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Medium: soci-snapshotter

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...