UBUNTU-CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

EUVD-2026-67207

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

PT-2026-82596

openssl encrypt versions before 1.4.9 fail to escape attacker-controlled key id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key id containing escape sequences to repaint terminal output and forge authenticity verification blocks...

Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

MAL-2026-14533 Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

SUSE CVE-2026-74274

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by cxl driver. This means cxl driver always assumes the first p-nrtargets...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The SonicWall NetExtender Linux client is vulnerable to an Improper Link Resolution Before File Access (CWE-59) vulnerability within the NEService auto-upgrade process . This flaw arises because the process insecurely handles temporary files, allowing an attacker to manipulate file paths . The vu...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

EUVD-2026-65960

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-78678 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

PT-2026-81518

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description The NEService auto-upgrade process insecurely handles temporary files, which allows an attacker to manipulate file paths. Recommendations At the moment, there is no...

CVE-2026-66153: Improper Link Resolution Before File Access

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-76072

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...