CVE-2026-68554 Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

EUVD-2026-63078

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

CVE-2026-68554

Coturn (open-source TURN/STUN server) prior to 4.15.0 is vulnerable to an on-path STUN message truncation attack. The root cause is that the server-side parser in src/server/ns_turn_server.c continues processing attributes after the MESSAGE-INTEGRITY field. Since the HMAC covers only the message ...

GO-2024-2456 vulnerabilities

Vulnerabilities for packages: goreleaser, bom, gitness, gitsign, go-licenses, src-fingerprint, pulumi-kubernetes-operator, nuclei, scorecard...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: grafana-alloy, zarf, timoni, pulumi-language-yaml, src-fingerprint, gitsign, trivy, wolfictl, tfsec, kots, flux, flux-kustomize-controller, bom, pulumi-language-dotnet, pulumi-kubernetes-operator, snyk-cli, grype, flux-image-automation-controller, skaffold, gitea, k9...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: grafana-alloy, zarf, timoni, pulumi-language-yaml, src-fingerprint, gitsign, trivy, wolfictl, tfsec, kots, flux, flux-kustomize-controller, bom, pulumi-language-dotnet, pulumi-kubernetes-operator, snyk-cli, grype, flux-image-automation-controller, skaffold, gitea, k9...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: grafana-alloy, rancher-fleet, teleport, zarf, pulumi-language-yaml, src-fingerprint, gitsign, trivy, wolfictl, tfsec, kots, flux, bom, steampipe, pulumi-language-dotnet, argo-cd, pulumi-kubernetes-operator, snyk-cli, grype, flux-image-automation-controller, skaffold,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: falcoctl, rabbitmq-messaging-topology-operator, zarf, sops, flux-helm-controller, src-fingerprint, glab, gitsign, terragrunt, step-ca, slsa-verifier, flux-notification-controller, terraform, aactl, ksops, tekton-chains, rook, sigstore-scaffolding, vexctl, flux,...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. The API function sshgethexa is vulnerable to a denial-of-service attack when processing zero-length inputs. This vulnerability can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication, if the...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

MAL-2026-13443 Malicious code in diezyyasha-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...

MAL-2026-12127 Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

Malicious code in a.poltoradnev-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a193f48dce179cc9b43bc16917f5a04d89975c3451ebd33f766545c1c168664 index.js the package main requires setup.js, which schedules bootstrap on process.nextTick, so the dropper fires on any require of the package...

MAL-2026-12137 Malicious code in accounts-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

CVE-2026-24080

Memory Corruption when handling malformed request parameters in the fingerprint TA...

CVE-2026-24080 Buffer Copy Without Checking Size of Input in Biometrics

Memory Corruption when handling malformed request parameters in the fingerprint TA...

EUVD-2026-52733

Memory Corruption when handling malformed request parameters in the fingerprint TA...

CVE-2026-24080

The CVE-2026-24080 entry describes a memory corruption issue in the fingerprint TA when processing malformed request parameters. The vulnerability affects a component related to biometric fingerprint handling and is associated with local attack vector, requiring low privileges and provides no use...

CVE-2026-43730

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...