CVE-2026-56082 Supabase - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC

Capgo Cap-go/capgo before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.recordbuildtime, which is granted to the anon role and callable with only the public Supabase publishable sbpublishable anon key. An unauthenticated attacker...

CVE-2026-56082 Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC

Capgo Cap-go/capgo before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.recordbuildtime, which is granted to the anon role and callable with only the public Supabase publishable sbpublishable anon key. An unauthenticated attacker...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: OSV:GHSA-V75R-VX73-82PJ...

Missing Authorization

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Missing Authorization via the buildDefaults action in DevelopmentAdmin. An attacker can perform unauthorized database modifications and obtain...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildRequestUrl function. An attacker can access or modify unintended API endpoints by supplying crafted path variables containing special characters, which are inserted into the request URL...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: octeonep VF: Added NULL checks for napibuildskb. The napibuildskb function can return NULL when allocation fails. In octep VFoqprocessrx, the result is used directly without a NULL check in both the single-buffer and...

Malicious code in build-tracker-n5p1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e731775fde27ad6db493d20397b27eee9b4a6ea0bf515f9516cc974ea3e12619 Package name suggests build telemetry tooling, but the tarball ships beacon scripts beacon18.js, beaconlinux.js wired to a postinstall lifecycle hook...

MAL-2026-6196 Malicious code in build-tracker-n5p1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e731775fde27ad6db493d20397b27eee9b4a6ea0bf515f9516cc974ea3e12619 Package name suggests build telemetry tooling, but the tarball ships beacon scripts beacon18.js, beaconlinux.js wired to a postinstall lifecycle hook...

@angular-devkit/build-angular (22.1.0-next.0), @oslokommune/auth-bff (>=2.0.1, <=2.2.1) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)

http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =8.8.3 Source cves: CVE-2026-55603 Source advisory: SNYK:JS-HTTPPROXYMIDDLEWARE-17375007...

@angular-devkit/build-angular (22.1.0-next.0), @oslokommune/auth-bff (>=2.0.1, <=2.2.1) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)

http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =8.8.3 Source cves: CVE-2026-55603 Source advisory: OSV:GHSA-GCQ2-9PQ2-CXQM...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +168 more potentially affected by CVE-2026-55388 via piscina (>=4.0.0, <=4.9.2)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.35 and more Source cves: CVE-2026-55388 Source advisory: SNYK:JS-PISCINA-17817071...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +168 more potentially affected by CVE-2026-55388 via piscina (>=4.0.0, <=4.9.2)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.35 and more Source cves: CVE-2026-55388 Source advisory: OSV:GHSA-X9G3-XRWR-CWFG...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +726 more potentially affected by CVE-2026-6733 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-6733 Source advisory: SNYK:JS-UNDICI-17372752...

MAL-2026-5977 Malicious code in cryptodao-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...

openSUSE 16 Security Update : neonmodem (openSUSE-SU-2026:20963-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20963-1 advisory. Changes in neonmodem: - Update golang.org/x/net dependency to v0.55.0 due to bsc1267193 - Update golang.org/x/image dependency to v0.38.0 due to...

ALSA-2026:26455 Important: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: unbounded LDAP controls count in...

GHSA-QP5J-JR73-M2PW Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24vr-rprv-67rf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env...

MAL-2026-5926 Malicious code in test-copppss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe On npm install, the package's preinstall hook node index.js /dev/null 2&1 runs a shell pipeline that collects host identifiers — hostname, pwd, whoam...

kernel: Buffer overflow in drivers/xen/sys-hypervisor.c

A flaw was found in the Linux kernel. A buffer overflow vulnerability exists in the Xen hypervisor driver drivers/xen/sys-hypervisor.c. This flaw occurs because the HYPERVISORxenversionXENVERbuildid function returns a build ID that is not properly null-terminated. When the buildidshow function...

CVE-2026-53846

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npmexecpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager...