CVE-2026-76242

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can...

CVE-2026-54730

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

DEBIAN-CVE-2026-43971

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

CVE-2026-72130

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

CVE-2026-72296

A flaw was found in the Linux kernel's In-band Flow Engine IFE component. A remote attacker could send a specially crafted IFE frame with a malformed inner Ethernet header. This improper handling of the packet structure could lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

EUVD-2026-59558

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

PT-2026-72847

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89 hw scan add chan ax for over 20 seconds, leading to a...

PT-2026-72864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc recvmsg Fix a double unlock in rxrpc recvmsg when dealing with OOB messages...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The CVE concerns the Paymob for WooCommerce WordPress plugin (versions

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

Malicious code in @jacksher/install-exec-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423 package.json declares postinstall: node beacon.js. On every npm install, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to...

MAL-2026-13934 Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

MAL-2026-13348 Malicious code in lakk-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a1a1a5f0fd81e6ba6198e7f4cbdeab1c16b8ceed3dbb7becc6b4b6f611ad52 [email protected] runs node index.js from an npm install lifecycle hook, which loads ./lib/core and constructs a subdomain from the installer's O...

Malicious code in @kite-js-tools/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9 package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET ...

MAL-2026-12482 Malicious code in tool-registry-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b635b8b6d257c079a0d0a9c06e37910b67f2e75d1e71dced264043624951ce06 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, homedir, DNS...

Malicious code in pp-react-worldready-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...