CVE-2026-71196

A server-side request forgery SSRF vulnerability was found in OpenStack Glance. The web-download image import method allows authenticated users to provide a URI from which the Glance service fetches data. Due to insufficient default host filtering, an attacker with standard tenant credentials can...

Security update for python-h2

This update for python-h2 fixes the following issue: CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3972-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

Security update for python-h2

This update for python-h2 fixes the following issue: CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3970-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

Malicious code in content-publisher-sdks (npm)

Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir, DNS server list, current working directory, package.json...

Malicious code in code-analyzer-mcp (npm)

Source: amazon-inspector 41c70b60414be4e045ae4c1eff1ab33b674c78cc9e2eadadfbdca6317de3a251 index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched via the package's main/bin entry. The IIFE spawns calc.exe through childprocess.execSync and runs reconnaissance...

Malicious code in cobrowsing-test-utils (npm)

Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays Cloudflare Workers subdomains...

Malicious code in claims-auth-api-adapters (npm)

Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from Cloudflare workers.dev hosts whose names are assembled from...

Malicious code in checkout-bnpl-logic (npm)

Source: amazon-inspector cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require"./polyfill", which runs on every consumer import. polyfill.js reassembles...

Malicious code in chart-data-utils (npm)

Source: amazon-inspector 3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9 [email protected] advertises itself as a chart data/color helper library index.js contains only trivial color utilities, but ships a postinstall.js that runs at npm install time and performs credential...

MAL-2026-15925 Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

ALCASAR Host Header RCE

Exploits ALCASAR command injection via a crafted Host header on /alcasar/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host header command injection RCE — execute session.""" from future import annotations import re from kittysploit import...

Malicious code in easypanel-docker (npm)

Source: amazon-inspector d43ed7789fb269c2613ce7b2442fdceab1b5e8b5360048d7bda2a63f0e9fac63 The preinstall lifecycle script collects host fingerprint data os.hostname, os.userInfo.username, process.cwd, and CI-related environment variable names, base64url-encodes the JSON payload, sanitizes it into...

sshroute v0.2.12

sshroute CI | Code | OpenSpec | Security ---|---|---|--- | | |...

Malicious code in @avigilon/node-webrtc (npm)

Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own package.json, then collects host identifiers os.hostname,...

Malicious code in mcp-consultasdeveiculos-client (npm)

Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads os.hostname, os.userInfo.username, platform, arch, node...

EUVD-2026-70850

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

SUSE CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...