CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting

Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component. id: CVE-2024-31839 info: name: CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting author: riteshs4hu severity:...

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

GHSA-FF9F-JF42-662Q

creationtimestamp| type| source ---|---|--- 2026-07-17 21:19:56+00:00| seen| https://chaos.social/users/christopherkunz/statuses/116937404931312120 2026-07-20 13:00:41+00:00| seen| https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar 2026-07-20...

CVE-2026-63030

creationtimestamp| type| source ---|---|--- 2026-07-17 21:19:56+00:00| seen| https://chaos.social/users/christopherkunz/statuses/116937404931312120 2026-07-17 22:19:07+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o 2026-07-17 22:53:06+00:00| seen|...

Security Bulletin: Vulnerability in BIND (CVE-2026-3592, CVE-2026-5946) affects AIX/ VIOS.

Summary CVE-2026-3592: Resolver queries a specially crafted zone containing self-pointed glue records, causing disproportionate resource consumption. CVE-2026-5946: Specially crafted DNS messages using non-IN classes e.g., CHAOS, HESIOD, ANY, NONE trigger assertion failures, terminating the named...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: helm-fips, kubescape-operator-fips, eksctl, chainctl, envoy-gateway, neuvector, tigera-operator-fips, syft-fips, xeol-fips, helmfile, kargo, kaniko-fips, spegel, kubescape-server, gitlab-rails-ce, gatekeeper, helm-exporter-fips, dagger,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: helm-fips, kubescape-operator-fips, eksctl, chainctl, envoy-gateway, neuvector, tigera-operator-fips, syft-fips, xeol-fips, helmfile, kargo, kaniko-fips, spegel, kubescape-server, gitlab-rails-ce, gatekeeper, helm-exporter-fips, dagger,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: helm-fips, kubescape-operator-fips, eksctl, chainctl, envoy-gateway, neuvector, tigera-operator-fips, syft-fips, xeol-fips, helmfile, kargo, kaniko-fips, spegel, kubescape-server, gitlab-rails-ce, gatekeeper, helm-exporter-fips, dagger,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: helm-fips, kubescape-operator-fips, eksctl, chainctl, envoy-gateway, neuvector, tigera-operator-fips, syft-fips, xeol-fips, helmfile, kargo, kaniko-fips, spegel, kubescape-server, gitlab-rails-ce, gatekeeper, helm-exporter-fips, dagger,...

MAL-2026-6027 Malicious code in @mastra/mcp-registry-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45ba997a42d41e72f38a36e0a6122b28388f73eb479dc41f7c1b77b6a75f91c8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in yelp-react-component-chaos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 711cd262cc670c0e66cf2878b6fa22db21a2e420313a58aa029cbc619f2b27cc On npm install, preinstall.js collects hostname, username, cwd, network interfaces, and the names of environment variables matching...

CVE-2026-36618

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

CVE-2026-36618

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

Mercusys AC12G 信息泄露漏洞

The Mercusys AC12G is a Gigabit wireless router produced by the Chinese company Mercusys. The Mercusys AC12G EU V1 AC12G EU V1 version has a security vulnerability. This vulnerability stems from the response to the CHAOS TXT query, and it may lead to the disclosure of the DNS resolver software...

CVE-2026-36618

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

PT-2026-46004

Mercusys AC12G EU V1 with firmware AC12GEU V1 200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

CVE-2026-36618

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version unbound 1.22.0, aiding targeted attacks against known vulnerabilities...

CVE-2026-36618

Mercusys AC12G (EU) V1 devices (firmware AC12G(EU)_V1_200909) are affected. The issue arises because the DNS resolver (unbound 1.22.0) reveals its version when responding to version.bind CHAOS TXT queries, which can aid targeted attacks against known vulnerabilities. The vulnerability pertains to...

CVE-2026-5946

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet IN — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes ANY or NONE in the question section. Specially crafted requests reaching the affected code paths — recursio...