Malicious code in dev-helper-bg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...

Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

PT-2026-63560

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Rules configured via rewrites or redirects that construct an external destination hostname using request-controlled input can be manipulated to point t...

ROS-20260722-73-0030

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability could allow an attacker to cause service interruptions...

PT-2026-63476

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of externally sourced BSON Binary JSON data during aggregation pipeline processing on a standalone mongod instance can lead to memory corruption. This may result in...

Oracle WebCenter Portal (July 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported...

ROS-20260722-73-0019

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XmlDecoder file when XML input containing a DOCTYPE declaration is processed by an AsyncXMLInputFactory without security configuration, leaving DTD and entity handling enabled. An attacker can...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

DEBIAN-CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817

Netty CVE-2026-56817 affects Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final, where any caller delivering bytes to a channel pipeline containing XmlDecoder can send XML with a DOCTYPE to an AsyncXMLInputFactory started without security configuration, leaving DTD/entity handl...

CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

GHSA-9WJQ-CP2P-HRGF Loofah: SVG `href` attribute bypasses local-reference restriction

Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

GHSA-MHM7-754M-9P8W jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

Summary In BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId, the active-view @JsonView filter was applied only to the regular bean-property branch; the creator-property branch performed no creatorProp.visibleInViewactiveView check. A constructor parameter annotated with both...

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to...