MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)

@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...

Elasticsearch 7.17.5 / 17.17.29 / 8.2.2 < 8.19.19 / 9.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-188)

The version of Elasticsearch installed on the remote host is prior to 8.19.19, 9.3.8, 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-188 advisory. - Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing...

PT-2026-108984

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101 Description The rpc function in api blueprint.py handles multipart/form-data uploads by reading the entire content of the uploaded file into memory using file.read before sending the data to the underlyi...

CVE-2026-48484: Improper Input Validation

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

PT-2026-108885

Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0...

PT-2026-108954

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a element nested within MathML foreign conten...

ROS-20261009-73-0281

The vulnerability of the tegrachanneltryformat function in the drivers/staging/media/tegra-video/vi.c file of the Linux kernel’s media data preparation driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

Aiohttp HTTP Client Source Verification Confidential Data Access

The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

Linux Distros Unpatched Vulnerability : CVE-2026-44034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes ...

ROS-20261009-73-0139

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-108769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf component where an LWT SEG6LOCAL program can invalidate its cached Segment Routing Header SRH using the bpf lwt seg6 adjust srh function and subsequently call...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...

PT-2026-108875

Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks versions prior to 1.3.32 Description An issue in the all-bootstrap-blocks component allows the retrieval of embedded sensitive data, leading to the exposure of sensitive system information to an unauthorized control sphere...

Cisco Application Policy Infrastructure Controller Message Data Compromise

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to insufficient assurance of the correctness of messages or data structures. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

Data Sharing Service Windows Privilege Escalation

The vulnerability of the Data Sharing Service client for the Windows operating system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to increase their privileges...

HTTP/3 Server Data Compromise

The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...

Aiohttp HTTP Client Unauthorized Access

The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20261009-73-0553

The vulnerability of the initkfdvm function in the drivers/gpu/drm/amd/amdgpu/amdgpuamdkfdgpuvm.c driver for AMD GPU cores in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

PT-2026-108749

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...