Malicious code in @client-web-next/env-util (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16500 Malicious code in @client-web-next/event-bus-listener (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16498 Malicious code in @client-web-next/cms (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16497 Malicious code in @client-web-next/api-metrics (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/api-metrics (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/cms (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16496 Malicious code in @client-web-next/analytics (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/analytics (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16494 Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/adaptive (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16495 Malicious code in @client-web-next/adaptive (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/ab-landing-form (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16493 Malicious code in @client-web-next/ab-landing-form (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-83603

The open source observability tool Netdata contains a privilege escalation vulnerability in the setuid-root ndsudo helper command (fail2ban-client-status-socket) located in src/collectors/utils/ndsudo.c. A low-privileged netdata service account can provide a caller-controlled --socket_path to dir...

CVE-2026-83603 Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

CVE-2026-83603 Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

EUVD-2026-84564

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

CVE-2026-83603 Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials

A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request. The flaw, tracked as CVE-2026-90898 CVSS score: 9.8, affects all versio...