Malicious code in npm-wold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...

MAL-2026-14252 Malicious code in npm-wold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...

MAL-2026-14222 Malicious code in streak-cal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287 index.mjs the package's main entry contains a 500 KB base64-encoded x86-64 ELF payload stored in a store array disguised with a // --- Calibration Da...

The vulnerability of the to_char(timestamptz) function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the tochartimestamptz function in the PostgreSQL database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

MiracleLinux 8 : haproxy-1.8.27-5.el8_10.2 (AXSA:2026-1575:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1575:02 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...

MAL-2026-14140 Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

SUSE CVE-2026-68147

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...

GHSA-FWWX-3362-3947 Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...

RLSA-2026:55679 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

WordPress ECS plugin < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability

Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability discovered by Seongwon LEE in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

WordPress ECS plugin < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability

Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability discovered by Shivamani Vastrala in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

RLSA-2026:55859 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 For more details about the security issues, including the impact, a CVSS score...

RHEL 8 : haproxy (RHSA-2026:55860)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:55860 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProx...

ROS-20260818-73-0040

The vulnerability in xrdp is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260818-73-0038

The vulnerability in xrdp is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

dyen macOS In-Memory Mach-O Loader

dyen is a macOS in-memory Mach-O dynamic library loader designed to execute a dylib using the stock Python interpreter without writing the decrypted Mach-O to disk or registering the payload with dyld. It supports encrypted standalone payloads and encrypted dylibs appended to otherwise valid cove...

RockyLinux 8 : haproxy (RLSA-2026:55859)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55859 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...