CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-66324

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Malicious code in 3layerdipstack1ykdgn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabe62f28af88a694847d251ec0545bcdfe498e5bf37df3e5d32552bfd10aae3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14835 Malicious code in 3layerdipstackmokfkh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da015575c29fe6af032ba0c966d1adcdab17b367ca32bfb54fb11bbcfa4d890c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14605 Malicious code in 3layerdipstack1lkqg9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3055362817a22386f2c0e5db959db42444b9c60d620c9c8453ee196a1d0e8fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14905 Malicious code in 3layerdipstackrcuf3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f32fc4b5be00ab27d18166f1514a8f15761114c074e5d674aab11e8418fe715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14825 Malicious code in 3layerdipstackm1j2h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fd15af8c52e8e1dd4a62c42938fdd7f64aa6f5230de59210dc82d6e79e2b8fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14866 Malicious code in 3layerdipstackp4yyc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f8ac522f4af3c94f5c7224d72eeb488ffd9cfcce465b5308bce689140631706 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14624 Malicious code in 3layerdipstack4iivta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d3d58aee204e2100f687789f6a289319f32965af1e8dd324767d40be1b36d0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackjnh4m1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbafb2120a0c1a9e305f4904a3c753b097417bf2d6ac4348ca6ff493649b0d55 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmos-graphing-v01eezwb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78046a66dc5cc0fb77d380c2a58f494e4d6bc0d8cc103016754567739f3103c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-vxtbz5de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba9e06cf661b8e6c80f1e5f5303f8ce9537a9cf909f5110848364a0565a2aae3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15460 Malicious code in secure-test-browser-yp88o07w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fcdde9a08c190c554d2681d2eb758290d0c6f58d3cb7b4504cb1c9502d893fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15463 Malicious code in secure-test-browser-z2j7z8ae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f63bad7d6413d1737998c772e15d947abb65965d5def33c308c02c93b241462 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-80700

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

CVE-2026-76797: Improper Neutralization of Formula Elements in a CSV File

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...