GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards, tileserver-gl, langfuse, sqlpad, saf, json-server, prism, py3-jupyterlab, kubeflow-katib, kubeflow-pipelines, code-server, thingsboard, renovate, kubeflow-centraldashboard...

CVE-2026-8723 vulnerabilities

Vulnerabilities for packages: unleash, saf, gitlab-rails-ce-fips, wazuh-dashboard-fips, kubeflow-centraldashboard, py3-captum, prism, langfuse, kibana, opensearch-dashboards, opensearch-dashboards-fips, tileserver-gl, arangodb, json-server, py3-jupyterlab, thingsboard, code-server,...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: unleash, saf, gitlab-rails-ce-fips, wazuh-dashboard-fips, kubeflow-centraldashboard, py3-captum, prism, langfuse, kibana, opensearch-dashboards, opensearch-dashboards-fips, tileserver-gl, arangodb, json-server, py3-jupyterlab, thingsboard, code-server,...

Malicious code in @antv/gl-matrix (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4019 Malicious code in @antv/gl-matrix (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

1g6table (=0.1.0), @actonate/mirkwood-rx (=0.10.9) +1549 more potentially affected by unknown CVE via @antv/gl-matrix (=2.7.1)

@antv/gl-matrix NPM version =2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/gl-matrix and may be impacted: - 1g6table =0.1.0 - @actonate/mirkwood-rx =0.10.9 - @aegis.inc/flow =0.0.1-beta, =0.1.0, =0.5.0-alpha.0, =0.1.0, =0.5.0-alpha.0,...

EUVD-2023-50669

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

GHSA-J452-XHG8-QG39 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, opensearch-dashboards-fips, wazuh-dashboard-fips, tileserver-gl-fips, wazuh-dashboard...

CVE-2026-5758 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, opensearch-dashboards-fips, wazuh-dashboard-fips, tileserver-gl-fips, wazuh-dashboard...

CVE-2026-5758 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl...

GHSA-J452-XHG8-QG39 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl...

CVE-2026-22166 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the...

JLSEC-2026-365

A potential memory leak issue was discovered in SDL2 in GLESCreateTexture function in SDLrendergles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected...

CVE-2026-5959

A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The...

CVE-2026-5959

A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The...

CVE-2026-5959 GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication

A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The...