MAL-2026-12050 Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

EUVD-2026-52932

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-67863

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UASubscriptionlocalPublish continues to use the current UANotification after a callback invokes UAServerdeleteMonitoredItem for the current local MonitoredItem. This allows a...

CSRF vulnerability and missing permission checks in scm-manager

scm-manager 1.11.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CVE-2026-67870

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-12004 Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

CVE-2026-46334

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-46334 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-45537

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-67862

A flaw was found in open62541. A buffer-overflow vulnerability exists in the high-level attribute reading logic. This flaw allows a remote attacker to trigger a denial of service, making the affected system unavailable...

CVE-2026-67859

A flaw was found in open62541. A remote attacker can exploit a buffer overflow vulnerability in the Discovery/LDS Local Discovery Server handling. This can lead to a denial of service, making the affected system unavailable...

openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

CVE-2026-51401

A flaw was found in Vim. A local attacker could exploit a vulnerability in the vmsfixfilename function, allowing them to execute arbitrary code on the system. This could lead to a complete compromise of the affected system. Mitigation No mitigation is required. Red Hat does not ship any product...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-67861

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

UBUNTU-CVE-2026-67855

open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UAENABLEGDSPUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service...

CVE-2026-67856

A flaw was found in open62541. A remote attacker could exploit this vulnerability by sending specially crafted subscription-related requests, such as CreateSubscription or Publish. This could lead to a denial of service DoS, making the affected system unavailable to legitimate users...

CVE-2026-67858

A flaw was found in open62541. When the Local Discovery Server LDS is configured with multicast discovery via the MDNSD backend, an unauthenticated remote attacker can exploit a buffer overflow vulnerability. By sending numerous unique discovery URLs in RegisterServer or RegisterServer2 requests,...