MAL-2026-14265 Malicious code in easydsbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...

CVE-2026-75593: Improper Limitation of a Pathname to a Restricted Directory

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

PT-2026-80789

Name of the Vulnerable Software and Affected Versions Drupal Gammu SMS Daemon versions . Description A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. Recommendations At the...

PT-2026-80790

Name of the Vulnerable Software and Affected Versions Drupal Gammu SMS Daemon versions . Description A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. Recommendations At the...

PT-2026-80791

Name of the Vulnerable Software and Affected Versions Drupal Gammu SMS Daemon versions . Description A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. Recommendations At the...

RHEL 10 : libcupsfilters (RHSA-2026:56965)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:56965 advisory. Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional file...

SUSE SLES12 Security Update : rsync (SUSE-SU-2026:3629-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3629-1 advisory. - CVE-2026-29518: Symlink-Race TOCTOU in Daemon bsc1264511. - CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls bsc1264514. Tenabl...

Linux Distros Unpatched Vulnerability : CVE-2026-75900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is ...

PT-2026-78321

Name of the Vulnerable Software and Affected Versions swtpm affected versions not specified Description An out-of-bounds read exists in the SWTPM NVRAM CheckHeader function. The issue occurs because the entry guard validates the buffer length using sizeofbh, which refers to the size of a pointer,...

CVE-2026-75900: Out-of-bounds Read

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-44254: Incorrect Calculation of Buffer Size

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

PT-2026-78506

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/os crypto/shared/msgs.c decompresses up to OS MAXSTR...

CVE-2026-15792

A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service DoS, making the BuildKit service unavailable. Mitigation Avoid building container images using...

CVE-2026-24184

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol LLDP daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution...

CVE-2026-24184

An unauthenticated attacker on an adjacent network can trigger a buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux via crafted LLDP frames, potentially leading to code execution. CVSS 3.1 scores this HIGH (7.5) with no privileges required; exploitation details are not publicly available....

EUVD-2026-61104

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol LLDP daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution...

CVE-2026-24184

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol LLDP daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution...

SUSE CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

SUSE CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...