EUVD-2026-64976

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

Malicious code in dims-svelte-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bad5399590f49863bf42eff11c2a4c9f22c7db3dbc91d710faa0dfc732f02a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MSC-2026-11438

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11436

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11437

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11435

Malicious dependency-confusion package same campaign as web-advertising 999.9.16. Published at version 999.9.16 to override an internal package of the same name. A silent preinstall hook node index.js auto-executes on install, collects a host reconnaissance fingerprint hostname, username, home/cw...

MSC-2026-11434

Malicious dependency-confusion package. Published at version 999.9.16 to override an internal package of the same name via npm's highest-version resolution. A silent preinstall hook node index.js auto-executes on install, collects a host reconnaissance fingerprint hostname, username, home/cwd,...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict in resolve through the resolve process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ again...

Interpretation Conflict

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict in resolve through the resolve process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a...

Improper Validation of Syntactic Correctness of Input

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6 and parseWithStatus host-processing paths in lib/utils.js and index.js. An attacker can route an...

Improper Handling of URL Encoding (Hex Encoding)

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL...

MAL-2026-14405 Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MSC-2026-11433

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MAL-2026-14409 Malicious code in polis-diraja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71e55ed5112c3eba44560867e4b882d6c0135c379dd82eb8eb611f1aeb5f12b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in fast-uri

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in fast-uri. CVE-2026-16221 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 includin...

CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: vchiqarm: Avoid dereferencing a NULL pointer in vchiqdumpplatforminstances. vchiqgetstate may return a NULL pointer. Therefore, handle this case and avoid dereferencing a NULL pointer in vchiqdumpplatforminstances...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fixed the use of &phb-ioresource after calling deviceunregister&hostbridge-dev. However, if there are no outstanding references when calling deviceunregister, then phb may still be freed, even though...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: core: Fixed a regression related to the removal of the procfs host directory. The scsiprochostdirrm function decreases a reference counter; therefore, it should only be called once per host that is removed. This change...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host – Fixed the dereference issue in the DDMA completion flow. The dereference issue in the DDMA completion flow has been addressed...