undici vulnerable to CRLF Injection via blob-like body 'type' property

...

EUVD-2026-54275

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

RHEL 8 : libyang (RHSA-2026:51351)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51351 advisory. Libyang is YANG data modeling language parser and toolkit written and providing API in C. Security Fixes: libyang: libyang: Denial of Service or...

RHEL 8 : libyang (RHSA-2026:51339)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51339 advisory. Libyang is YANG data modeling language parser and toolkit written and providing API in C. Security Fixes: libyang: libyang: Denial of Service or...

RHEL 8 : libyang (RHSA-2026:51368)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:51368 advisory. Libyang is YANG data modeling language parser and toolkit written and providing API in C. Security Fixes: libyang: libyang: Denial of Service or...

libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lybreadstring function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer such as a...

Important: Red Hat Security Advisory: libyang security update

An update for libyang is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lybreadstring function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer such as a...

CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

The vulnerability of the drm_property_create_blob() function in the drivers/gpu/drm/drm_property.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drmpropertycreateblob function in the drivers/gpu/drm/drmproperty.c file of the Direct Rendering Infrastructure DRI driver in the Linux kernel is related to the loss or omission of information. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-71262

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

MAL-2026-12467 Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

Malicious code in streak-metricsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a707525e88d0f5d3004f833b17a7544655da43715d9d7af3e6d635ff3a6801a9 [email protected] presents itself as a calendar-day math helper but its main entry dist/index.mjs, the default exports target embeds a Linux x86-...

CVE-2026-71262 IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

EUVD-2026-53347

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71262

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71262 IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71262

IoTSharp’s BlobStorageController is missing authorization and lacks a global authorization policy, making Upload/Download/List/Modify/Delete endpoints accessible without authentication. The endpoints pass path/filename parameters to blob storage without sanitization, enabling path traversal to wr...