EUVD-2026-42958

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat." The company has temporarily disabled access to the affected accounts, a step it say...

MAL-2026-10135 Malicious code in theta-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1 [email protected] ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load,...

MAL-2026-10120 Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f891edea1f4959d4a81c055084d6e3fa6f4ab3dfb97435a2c393b741b9e15177 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54470

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-42875

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-54470

Dell Unisphere for PowerMax, versions up to 10.3.0.5, are affected by an Improper Restriction of XML External Entity Reference. The issue targets the XML parser in a network-accessible context and could allow a low-privileged, remote attacker to gain unauthorized access to sensitive data. The CVS...

CVE-2026-54470

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

The vulnerability of the fuel_gauge_external_power_changed() function in the drivers/power/supply/axp288_fuel_gauge.c driver of the Linux operating system’s power management driver, which allows a hacker to cause a service failure.

The vulnerability of the fuelgaugeexternalpowerchanged function in the drivers/power/supply/axp288fuelgauge.c file of the Linux kernel’s power management driver is related to the racing scenario. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS 2.0 SP12 : expat (EulerOS-SA-2026-2586)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer dereference with...

GHSA-2RMG-VRX8-9J2F psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in the redirect URL validation process. An attacker can cause users to be redirected to arbitrary external sites by crafting a specially formatted URL that bypasses host and schema checks using a double slash prefix in the...

CVE-2026-15000

creationtimestamp| type| source ---|---|--- 2026-07-09 22:33:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaouyr2752e...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

MAL-2026-10096 Malicious code in guest-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5244faa59fb08eaa6dec10250fe2218a4909cb06ecc6ac972fda38b144f2aaef Package publishes as version 99.0.0 under a name presented in its README as an unclaimed internal name, positioning it to win dependency-confusion...

MAL-2026-10095 Malicious code in fury_frontend-andes-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37 The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username os.userInfo, current working...

Malicious code in fury_frontend-andes-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37 The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username os.userInfo, current working...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: nrdot-collector, mesosphere-vsphere-csi, k9s-fips, kor, crossplane-provider-aws-schemas, cloud-provider-aws-fips, cri-tools, dragonfly-operator-fips, crossplane-provider-aws-kinesisvideo-fips, stern, crossplane-provider-aws-cloudwatchevents,...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: knative-serving, k8sgpt-operator, spicedb-operator, crossplane-provider-aws-ec2, nri-mongodb, datadog-agent, cilium-cli, envoy-ratelimit, bento, kapp-controller, terraform-provider-azuread, stern, git-lfs, thanos-operator, croc, src, terraform-provider-google,...