EUVD-2026-55502

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

PYSEC-2026-3634 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

EUVD-2026-54919

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

PT-2026-69313

Name of the Vulnerable Software and Affected Versions KS-GEN-AI jira-mcp-server version 0.2.0 Description An issue exists in the add attachment from public url component within the src/index.ts file. The axios.get function is susceptible to server-side request forgery SSRF, a condition where an...

PT-2026-69303

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer version 0.4.0 Description A flaw in the Authorization Header Parsing component allows remote attackers to cause a denial of service. The issue occurs within the parse token from header function located in the src/parse...

MAL-2026-13643 Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

CVE-2026-65819

CVE-2026-65819 affects gopacket before version 1.7.0, where multiple layer decoders may read attacker-controlled lengths, counts, or offsets before validating buffers. A crafted packet decoded via DecodingLayerParser or DecodeFromBytes can trigger an unrecovered panic, enabling unauthenticated re...

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

Malicious Package

Overview streak-map-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @mrbenty8jf1p9y5/oidc-bind-canary is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview streak-map-cache is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @lambda-platform/lambda-vue is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

GHSA-HH9P-6WH2-4MFC GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

Malicious Package

Overview dolyame-ui-inputsearch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview ded-pwa-test-pub-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bnpl-blocks-atom-bnpl-image-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

MAL-2026-13586 Malicious code in dolyame-ui-inputtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts...