CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

Shenron

Shenron 日本語版 README Shenron is a passive Rus...

CVE-2026-85226: Missing Authorization

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

VulnCheck KEV: CVE-2026-85046

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,...

PT-2026-85057

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

PT-2026-85234

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A race condition in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to open a specially crafted HTML page. A race condition...

openSUSE 16 Security Update : chromium (openSUSE-SU-2025:20032-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20032-1 advisory. Chromium 141.0.7390.122: CVE-2025-12036: Inappropriate implementation in V8 boo1252402 Chromium 141.0.7390.107: CVE-2025-11756: Use after free i...

Malicious code in artillery-engine-spark (npm)

The package artillery-engine-spark was found to contain malicious code. --- Credit: OpenSSF source...

AZL-99285 CVE-2026-78662 affecting package moby-engine 25.0.3-20

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99282 CVE-2026-56855 affecting package moby-engine 25.0.3-20

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99303 CVE-2026-18329 affecting package nginx for versions less than 1.30.4-1

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

UBUNTU-CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

EUVD-2026-70138

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-82398 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-82398 Source advisory: OSV:GHSA-FC8X-2RWW-XW9M...

Malicious code in tailwind-theme-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3a6ff1f2699ab0ea92a30416c4b043d70781bd4c7241c2fb497061a78866ab7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15846 Malicious code in tailwind-theme-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3a6ff1f2699ab0ea92a30416c4b043d70781bd4c7241c2fb497061a78866ab7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in tailwind-theme-engine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview arif-tempe11-sluey is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview arrogantpeafowlz3n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...