amavis

Installation Use your system's amavis package if possible. Prerequisites Software dependencies are tracked via Dist::Zilla. Some of them involve non-perl development libraries and GCC as a build dependency if obtained from CPAN: libdb libidn2 libssl libzmq3 On Debian 13 for example, one can insta...

pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1421 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.1.0, =0.1.1 and more Source cves:...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1421 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.1.0, =0.1.1 and more Source cves:...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

MAL-2026-10629 Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

CVE-2026-15033

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...

[SECURITY] Fedora 43 Update: sandogasa-0.15.3-2.fc43

A collection of tools and libraries for Fedora package maintenance and contributor activity tracking, built around shared API clients for Bugzilla, Bodhi, NVD, dist-git, Discourse, FASJSON, and HyperKitty. The name sandogasa =E8=8F=85=E7=AC=A0 refers to a Japanese straw hat of ten associated with...

[SECURITY] Fedora 44 Update: sandogasa-0.15.3-2.fc44

A collection of tools and libraries for Fedora package maintenance and contributor activity tracking, built around shared API clients for Bugzilla, Bodhi, NVD, dist-git, Discourse, FASJSON, and HyperKitty. The name sandogasa =E8=8F=85=E7=AC=A0 refers to a Japanese straw hat of ten associated with...

Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

...

Linux Distros Unpatched Vulnerability : CVE-2026-48860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN...

CVE-2026-48860

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inettlsdist:checkip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead...