Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

SUSE CVE-2026-50566

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability...

CVE-2026-9177

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-64283

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. An integer overflow vulnerability exists in the guestmemfd functionality when binding memory slots. A malicious guest operating system could exploit this by providing crafted offset and size values, leading to...

XenServer Security Update for Multiple Issues

Severity :High Description of Problem Several issueshave beenidentifiedthat affect XenServer 8.4 and XenServer 9. Collectively, these issues may allowa malicious privileged userin a guest VM to compromise or crash the host. Theseissueshavethe following identifiers: CVE-2026-42492XenServer 9 only...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 493d92c75a6ab0daa328300c9f6a6b177a8a4fd656b8f0431f60e11f1ef3e060 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11053 Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f35120670504586b6090e4cac9dd795b88170e1da09a6f0ad6955b665a6cda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10987 Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7304f03532008ba586815d08fdfa9fabde3615481804901bf96cba75fa38a1bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10816 Malicious code in @gocortexio/npmgremlinbox-cpol-1-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2184d51efaa813eba204f724caf876441f354323d358251674a60def88a83e9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10790 Malicious code in @gocortexio/npmgremlinbox-arphic-1999 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59cc9e27f4b008a76815433e388b21dadcb6477f6daee80a855b6eaeaf4a79f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10787 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90b8fc829bb9f06d6a3994a04e58fa96264a47e68e192ccbee66e67d227bb05d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10788 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff804db8ee3fdd69d5d86dcc0f4474be842aa41a5e700406f13e779794fd4f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2026-53359

CVE-2026-53359 A 16-year-old bug in the Linux kernel lets a re...

MAL-2026-10673 Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1b1b47b7f27eee6dee1bdd61d3744f11cf323adb9d3d677f13abec5e911007f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10647 Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9e1e6c4d6beaeee572dffd24a67ae5bc74026eb798b1677a1dfa52144e15aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10570 Malicious code in valid-scope (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8258d9b773ebc2f93cfb302421cba0c6047d258bb44355ec9ecd71ce74d2f90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10563 Malicious code in humanize-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 602dcf2b61d28dfcdb2a5e3d0193b27f087d7e1c1714eed7d6f16c5a495d12cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in abuden219 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de0c667d7c3cbfd4c96728443db8ac059d53487498341bd937cf2aaf738574a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18bc2a7c89f862926aab27d42ebc31ed5c39f90197170a9b87e1dca9ecf933f5 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...