RHEL 9 : opentelemetry-collector (RHSA-2026:65117)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65117 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

RHEL 9 : ignition (RHSA-2026:65336)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65336 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing fil...

MAL-2026-16018 Malicious code in @aircanada/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356e229b0e7aa4523c4bd61f176ee40d5e20a3d897bac1821057ffefc969ec12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @aircanada/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356e229b0e7aa4523c4bd61f176ee40d5e20a3d897bac1821057ffefc969ec12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @aircanada/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-16007 Malicious code in @caliperx2/components (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

Malicious code in @caliperx2/components (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

SUSE CVE-2026-50884

Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components...

CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-17631

Langflow OSS 1.0.0–1.10.2 is vulnerable to a non-blind server-side request forgery (SSRF) (CWE-918) caused by missing URL validation in flow components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. An authenticated attacker can...

CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-19301 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-19301

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by Server-Side Request Forgery (SSRF) due to missing or bypassable URL validation across multiple components. Specifically, the LMStudio and embeddings components pass a user-controlled base_url directly to httpx.AsyncClient without invo...

CVE-2026-19303 Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

CVE-2026-19305

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) in multiple components where a remote attacker with no prior authentication can supply attacker-controlled URLs that reach internal network hosts without adequate validation. Affected com...

HydraDragonAntivirus openedr-v2-release-9

Hydra Dragon Antivirus WARNING: Highly outdated documenation here but for reference I keep it. Other than OpenEDR, MBRFilter, Sanctum etc. directories are fully deperecated for performance. 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. 🎥 POC:...

Malicious Package

Overview @caliperx2/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-71626

A vulnerability in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information . The issue is located within the StoreWebhookRequest.php , UpdateWebhookRequest.php , and WebhookSingle.php components. While the technical root cause is not explicitly detailed in the provided doc...

EUVD-2026-71744

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

EUVD-2026-71745

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...