CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager: established connections are resolved by a two-byte local connection handle without verifying the datagram source against the registered remote address. An on-path attacker observi...

EUVD-2026-53875

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

MAL-2026-13405 Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

MAL-2026-13401 Malicious code in helmet-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2920)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2879)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

The vulnerability of the rds_conn_shutdown() function in the net/rds/connection.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the rdsconnshutdown function in the net/rds/connection.c module, which is part of the Linux kernel’s networking functions, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability could allow a malicious actor to cause service...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-2935)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

Malicious Package

Overview patchwork-os is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13363 Malicious code in @cliphijack/santaclaude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675 The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the...

net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input

A flaw was found in Net::IMAP, a Ruby client library for the Internet Message Access Protocol IMAP. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. When a raw string argument, derived from user-controlled...

CVE-2026-70435

The Jenkins SCM-Manager Plugin (version 1.11.1 and earlier ) is vulnerable to a missing permission check in several HTTP endpoints. This flaw allows an attacker with Overall/Read permission to force the application to connect to an attacker-specified URL using specific credentials IDs obtained vi...

net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input

A flaw was found in Net::IMAP, a Ruby client library for the Internet Message Access Protocol IMAP. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. When a raw string argument, derived from user-controlled...

CVE-2026-8458

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

CVE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

MAL-2026-12977 Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...

CVE-2026-10051

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input

A flaw was found in Net::IMAP, a Ruby client library for the Internet Message Access Protocol IMAP. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. When a raw string argument, derived from user-controlled...