MAL-2026-1847 Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

MAL-2026-1825 Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

CVE-2026-32694 Insecure Direct Object Reference attack via predictable secret ID in Juju

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...

MAL-2026-1596 Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Meta’s AI Glasses and Privacy

Surprising no one, Meta's new AI glasses are a privacy disaster. I'm not sure what can be done here. This is a technology that will exist, whether we like it or not. Meanwhile, there is a new Android app that detects when there are smart glasses nearby...

CVE-2026-27979

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...

CVE-2026-27979

Next.js CVE-2026-27979 affects Next.js 16.0.1 through 16.1.6 in non-minimal deployments with Partial Prerendering enabled. A request containing the next-resume: 1 header can cause unbounded postponed-body buffering, consuming memory and enabling DoS. The issue is fixed in 16.1.7 by enforcing size...

CVE-2026-27979 Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...

CVE-2026-27979 Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...

CVE-2026-27979

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...

CVE-2026-20643

creationtimestamp| type| source ---|---|--- 2026-03-18 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0313/ 2026-03-18 01:06:47+00:00| seen| https://bsky.app/profile/bleepingcomputer.com/post/3mhccchyew52y 2026-03-18 01:43:59+00:00| seen|...

CVE-2026-27979: Allocation of Resources Without Limits or Throttling

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...

CVE-2026-27811: Improper Neutralization of Special Elements used in a Command

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the /config/compare/ / /show endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability...

Kanboard 安全漏洞

Kanboard is a set of open-source visualization taskboards developed by Kanboard. This software allows for the customization of panels according to business needs. Versions of Kanboard prior to 1.2.51 contained security vulnerabilities. These vulnerabilities stemmed from the fact that the user...

CVE-2026-3090: Improper Neutralization of Input During Web Page Generation

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-29056: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint UserInviteController::register accepts all POST parameters and passes them to UserModel::create without filtering out the role field. An attacker who receives an...

CVE-2026-22727

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information...