MAL-2026-11131 Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-11137 Malicious code in jobber-app-template-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844a2ac73b588b6c0c7c370dd647685768992ff3e6b5ef492e6fc6dc6be240ce The package's preinstall hook runs index.js which fires automatically on npm install. The script collects host reconnaissance os.hostname,...

Malicious code in jobber-app-template-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844a2ac73b588b6c0c7c370dd647685768992ff3e6b5ef492e6fc6dc6be240ce The package's preinstall hook runs index.js which fires automatically on npm install. The script collects host reconnaissance os.hostname,...

MAL-2026-11126 Malicious code in app-sim-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...

XenServer Security Update for Multiple Issues

Severity :High Description of Problem Several issueshave beenidentifiedthat affect XenServer 8.4 and XenServer 9. Collectively, these issues may allowa malicious privileged userin a guest VM to compromise or crash the host. Theseissueshavethe following identifiers: CVE-2026-42492XenServer 9 only...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

buffer overruns in libfsimage iso9660 handling

ISSUE DESCRIPTION The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: The directory loop itself assumes a good record length. This is CVE-2026-42494. The calculation of the System...

vIRQ event channel binding may break Xenstore

ISSUE DESCRIPTION Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the...

BIT-THRIFT-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-50134

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, by controlling a server or its DNS, to redirect HTTP requests to a forbidden host. This bypasses the intended security policy, potentially leading to unauthorized access to resources or information disclosur...

Important: yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fixes: yelp: yelp-xsl: Overly Permissive Content Security Policy i...

Important: yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fixes: yelp: yelp-xsl: Overly Permissive Content Security Policy i...

OpenSSL 3.0.0 < 3.0.18 Multiple Vulnerabilities detected in Nginx

Brocade SANnav provides Security updates for CVEs disclosed in OpenSSL Security Advisory 30th September 2025. - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'noproxy' environment variable is set and the host portion of the...

CVE-2026-51268

Summary of concrete details found : CVE-2026-51268 is connected to a heap-based buffer overflow in ESP32-audioI2S 3.4.5, affecting the host parsing logic. The dismantle_host()/host() parsing of untrusted host and URL input leads to copying parsed segments (host, request_host, extension, query_str...

Linux Distros Unpatched Vulnerability : CVE-2026-48145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are...

PT-2026-65615

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description A server-side request forgery SSRF exists due to a time-of-check/time-of-use TOCTOU gap during DNS resolution. The software validates the resolved IP of a fetch target to block...

CVE-2026-51268

...

CVE-2026-51268

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65539

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of...