915 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-84642
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames,...
CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
UBUNTU-CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-82289: Server-Side Request Forgery (SSRF)
Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...
CVE-2026-10582
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
Malicious code in sme-rko-finance-front-payments-domain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...
MAL-2026-13660 Malicious code in sme-rko-finance-front-payments-domain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to...
MAL-2026-13648 Malicious code in sme-rko-finance-front-operations-special-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...
MAL-2026-13654 Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...
MAL-2026-13639 Malicious code in sme-rko-finance-front-operations-income (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...
Malicious code in sme-rko-finance-front-operations-income (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...
Malicious code in sme-rko-finance-front-operations-penalty (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames...
Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...
MAL-2026-13655 Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...
MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...
MAL-2026-13552 Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reac...