MSC-2026-11528

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11529

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11531

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11533

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11530

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11527

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

The vulnerability of the Forms component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data and influence the integrity of the data.

The vulnerability of the Forms component in Google Chrome and Microsoft Edge is related to improper protection against attacks through external physical channels. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data...

PT-2026-83884

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw in the SourceProvider allows an unauthenticated attacker to perform a remote file read. By sending a specially crafted XML body containing a DOCTYPE declaration that references extern...

CVE-2026-53508: External Control of File Name or Path

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

WordPress Suggestion Engine for WooCommerce plugin has a SQL injection vulnerability

The WordPress Suggestion Engine for WooCommerce plugin is an extension for WooCommerce. This plugin has a SQL injection vulnerability, which stems from the lack of validation for SQL statements that are executed against external inputs. Attackers can exploit this vulnerability to execute...

PT-2026-83968

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-82880: Improper Restriction of XML External Entity Reference

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

PT-2026-83784

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

Linux Distros Unpatched Vulnerability : CVE-2026-17615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending ...

CVE-2026-53507: Exposure of Sensitive Information to an Unauthorized Actor

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

MAL-2026-15498 Malicious code in aws-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b036991e88a4be9813e89ba9861b39ae37fbd9201d1bd017f81c8b33d5f5e44b package.json declares a dependency whose key equals the package's own name aws-blog with a value of https://repo.securityctrl.com/aws-blog instead of...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...