14144 matches found
CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
Malicious code in ts-enum-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55102 via hashi-vault-js (>=0.4.11, <=0.4.16)
hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55102 Source advisory: OSV:GHSA-5PQ8-3FFP-7W5M...
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...
CVE-2026-48702
CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...
CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...
CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...
MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-13997 Malicious code in @nolimit-agent/win32-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4e440b5c1a499bb904b604509fd09284195641769bcea441044c9b15720106 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @nolimit-agent/linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CLEANSTART-2026-PE02324 Security fixes in fulcio-fips 1.8.7-r1
Package fulcio-fips version 1.8.7-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...
CLEANSTART-2026-SK52724 Security fixes in cosign 3.1.2-r1
Package cosign version 3.1.2-r1 fixes 9 vulnerabilities: CVE-2026-54787, ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-49835, ghsa-9c54-x2g4-v92j...
CLEANSTART-2026-CB76425 Security fixes in consul-k8s 2.0.1-r1
Package consul-k8s version 2.0.1-r1 fixes 9 vulnerabilities: CVE-2026-46600, CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-50151, CVE-2026-50162...
RHSA-2026:54436 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
CVE-2026-48791
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...
PT-2026-71900
Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client,...
OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media
These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-73422
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:16+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6...
