CVE-2026-79772

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

MAL-2026-14505 Malicious code in voice-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4e872ad9052cdd5d86c4c1656c57e5a899513853824efc24d4636a3c1679e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in voice-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4e872ad9052cdd5d86c4c1656c57e5a899513853824efc24d4636a3c1679e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14504 Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14503 Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

Summary The fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

GHSA-PPX3-28RW-8FPF utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

Summary The fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-79772

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

EUVD-2026-65530

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769

Nokogiri (Ruby gem) versions before 1.19.4 contain an out-of-bounds memory read in the protected internal method Node#initialize_copy_with_args , which unwraps its source argument as an xmlNode without a type check. If application code calls this method with a non-Node argument (e.g., a Namespace...

CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-55541

PraisonAI is a multi-agent teams system that exposes a service via praisonai serve. Prior to version 4.6.58 , the --api-key flag was parsed by the CLI but the internal functions _create_agents_app() and _create_unified_app() did not install a credential check on the resulting application. As a re...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the chacha20poly1305cipher and aesocbcipher implementations under providers/implementations/ciphers/. An attacker can forge messages by supplying an empty ciphertext and a bad tag, then...

CVE-2026-20783

A flaw was found in the Intel NPU Driver firmware due to an improper conditions check. An unprivileged attacker with authenticated user access can exploit this vulnerability locally with low complexity and no user interaction. This can lead to a denial of service, severely impacting the...