MAL-2026-13402 Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

github.com/moby/buildkit: BuildKit: Information Disclosure via Improper Handling of NTFS Directory Junctions

A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows WCOW configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

MAL-2026-13386 Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

MAL-2026-13390 Malicious code in @xsat10/baileys-xsat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37ba86faab85b50d9ae903ee59c78a8b52e46797b4c003448cd9851cd774939b Package is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence patterns matched on lib/Utils/generics.js ping/GET references and...

EulerOS 2.0 SP15 : dnsmasq (EulerOS-SA-2026-2921)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root...

EulerOS 2.0 SP15 : dnsmasq (EulerOS-SA-2026-2880)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root...

MAL-2026-13435 Malicious code in @united-airlines-org/atmos-design-system (npm)

The package @united-airlines-org/atmos-design-system contains a malicious preinstall script in its package.json that runs automatically during installation. The script executes curl to send the machine's hostname, obtained via uname -n and base64-encoded, to the attacker-controlled endpoint...

Linux Distros Unpatched Vulnerability : CVE-2026-17583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these...

Tenable Sensor Proxy < 1.4.2 Code Injection (TNS-2026-21)

According to its self-reported version, the Tenable Sensor Proxy running on the remote host is prior to 1.4.2. It is, therefore, affected by code injection vulnerability as referenced in the TNS-2026-21 advisory. - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code...

MiracleLinux 9 : skopeo-1.22.2-7.el9_8 (AXSA:2026-1477:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1477:04 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive...

RHEL 9 : systemd (RHSA-2026:51134)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51134 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive...

RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - aom (Important) (RHSA-2026:51146)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51146 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

The vulnerabilities of the functions qla2x00_update_optrom() and qla2x00_manage_host_stats() in the driver/scsi/qla2xxx/qla_bsg.c module of the SCSI device driver for the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the functions qla2x00updateoptrom and qla2x00managehoststats in the drivers/scsi/qla2xxx/qlabsg.c module of the SCSI device driver for the Linux operating system are related to operations involving resources after their expiration. Exploiting these vulnerabilities could all...

PT-2026-68817

Name of the Vulnerable Software and Affected Versions h2 versions prior to 4.4.1 Description The software accepts request header blocks containing multiple Host headers and forwards all of them to the consuming application. When the consumer downgrades the connection from HTTP/2 to HTTP/1.1, the...

GHSA-279X-MWFV-VCQV Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

GHSA-GX4C-2HQX-CW2R rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

Vulnerability Details File: backend/s3/s3.go Lines: 1359-1380 functions s3CheckRedirect / s3RedirectCrossesHost Root Cause Commit e7b1eb774 released in v1.74.3 added a CheckRedirect policy for the S3 HTTP client whose purpose is to strip the X-Amz-Security-Token header the AWS STS session token...

GHSA-H4MF-4V27-HGGJ rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Summary The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain: - a same-host HTTPS-to-HTTP redirect preserves Authorization:...