MAL-2026-13670 Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...

Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4836c93e5c62158ffed799c206fa3713291692e10efae048c04fff0745f7070f Package [email protected] contains no code patterns matching known supply-chain attack fingerprints. N...

CVE-2026-66151

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash...

EUVD-2026-54645

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash...

CVE-2026-66151

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash...

CVE-2026-66151

CVE-2026-66151 affects SonicWall Global VPN Client (GVC) versions up to 4.10.8.1108. The issue is a local, out-of-bounds kernel memory read in the SWIPsec.sys driver that can cause a system crash. According to the available sources, the attack is local with LOW privileges and does not require use...

CVE-2026-66151

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash...

CVE-2026-47660 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...

Security Bulletin: IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

Summary IBM i Access Client Solutions ACS is vulnerable to multiple vulnerabilities CVE-2026-13094, CVE-2026-13105, CVE-2026-13433, CVE-2026-14866, CVE-2026-14875, CVE-2026-16695 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-13094 DESCRIPTION: IBM i Acces...

EUVD-2026-51399

CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...

EUVD-2026-51398

CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames...

CVE-2026-54211

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

EUVD-2026-54198

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily...

Cisco IOS XE Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a...

The vulnerability of the Extensible Messaging Client Protocol (XMCP) in Cisco IOS and Cisco IOS XE operating systems allows a perpetrator to induce a service failure.

The vulnerability of the Extensible Messaging Client Protocol XMCP in Cisco IOS and Cisco IOS XE operating systems lies in the lack of input validation for cyclic operations. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco IOS Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a malformed XMCP...

Linux Distros Unpatched Vulnerability : CVE-2026-34501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through...

SUSE CVE-2026-64598

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-48081

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...