Malicious code in @egencia/uitk-global-styles-6 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16517 Malicious code in @egencia/uitk-global-styles-6 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @egencia/uitk-global-styles (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16516 Malicious code in @egencia/uitk-global-styles (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-77254: Missing Authentication for Critical Function

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

PT-2026-96946

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Requests to the HTTP MCP endpoint without a per-user identity can reach tool handlers that utilize globally configured Jira or Confluence credentials. This allows a network caller to perform...

CVE-2026-77561

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

UBUNTU-CVE-2026-85495

pre-authentication global buffer overflow...

OESA-2026-3944 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp. Security Fixes: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a...

PT-2026-95778

Name of the Vulnerable Software and Affected Versions Real3D Flipbook Lite versions prior to 5.1.2 Description Stored Cross-Site Scripting is possible due to insufficient input sanitization and output escaping in the on shortcode and print global options functions. The issue occurs when shortcode...

CVE-2026-75883

The code in pppd that formats a response to a PEAP Request packet in peapresponse copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacketbuf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to...

UBUNTU-CVE-2026-75883

The code in pppd that formats a response to a PEAP Request packet in peapresponse copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacketbuf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to...

Malicious Package

Overview link-async-global-reveal-md is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview lint-staged-commitlint-global-superagent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Linux Distros Unpatched Vulnerability : CVE-2026-90188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creatio...

CVE-2026-54612

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...