CVE-2026-66296

The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...

CVE-2026-66296 Reflected XSS in oaskit's default HTML error handler

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-18607

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

MAL-2026-11508 Malicious code in beaver-ui-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0 [email protected] advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js...

Malicious code in beaver-ui-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0 [email protected] advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js...

EUVD-2026-52329

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

CVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

Important: Red Hat Security Advisory: Kiali 2.11.15 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.15 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

CVE-2026-15383

The CVE-2026-15383 entry concerns the Blog Floating Button WordPress plugin (versions up to and including 1.4.20). Affected component: the visitor User-Agent header is not sanitized/escaped when stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator ...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size

A flaw was found in the perl-Archive-Tar component. An attacker can exploit this vulnerability by providing a crafted tar header with an excessively large entry size field. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size

A flaw was found in the perl-Archive-Tar component. An attacker can exploit this vulnerability by providing a crafted tar header with an excessively large entry size field. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size

A flaw was found in the perl-Archive-Tar component. An attacker can exploit this vulnerability by providing a crafted tar header with an excessively large entry size field. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...