MAL-2026-385 Malicious code in blocks-builder-manifest-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30f5efa34a1c44d974502110177cb7a60daf579349ed25937e66e342f7f7c24f The package blocks-builder-manifest-generator was found to contain malicious code. Source: ghsa-malware...

Server-Side Request Forgery (SSRF)

Umbraco CMS is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the baseUrl parameter in dashboard and help controller endpoints, which allows an attacker to craft requests that force the server to make unauthorized requests to external hosts...

MAL-2026-369 Malicious code in mw-shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf3e97618076e4e55a66ab4e6db0bd9af5787726d301e9cd90b7884efd085977 The package mw-shared-utils was found to contain malicious code. Source: ghsa-malware fc9d8c69691da9ebbb33986c4ad9eb26e4c1209546e369313ae26ff09cc378c...

Malicious code in mw-shared-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf3e97618076e4e55a66ab4e6db0bd9af5787726d301e9cd90b7884efd085977 The package mw-shared-utils was found to contain malicious code. Source: ghsa-malware fc9d8c69691da9ebbb33986c4ad9eb26e4c1209546e369313ae26ff09cc378c...

Malicious code in shared-global-ec-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac32ab19d7e9c15b0c6a69dafe143c75cab5612b903293c16865f371b8a00a7 The package shared-global-ec-uikit was found to contain malicious code. Source: ghsa-malware...

PT-2026-3744

Impact If Windows MDM is enabled, an attacker could exploit a cross-site scripting XSS vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser. A compromised...

MiracleLinux 8 : systemd-239-68.el8.4 (AXSA:2023-5147:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5147:05 advisory. systemd: local information leak due to systemd-coredump not respecting fs.suiddumpable kernel setting CVE-2022-4415 Tenable has extracted the preceding...

Malicious code in internallib_v355 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dba9a4166fd959eea5357952f1ffba736b4e6c9176ddeff85e0aeb1592edef8 The package internallibv355 was found to contain malicious code. Source: ghsa-malware 41e49779a105339cef2addb161d2a79d3aa2e22201f862ba6c3ef2af1ab1ccd...

Linux Distros Unpatched Vulnerability : CVE-2026-23884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves gdi-drawing pointing to freed memory,...

Linux Distros Unpatched Vulnerability : CVE-2026-22865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, so...

DEBIAN-CVE-2026-22816

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these...

CVE-2026-22816

CVE-2026-22816 (Gradle) : Multiple sources describe a vulnerability in Gradle before 9.3.0 where non-fatal exceptions during dependency resolution would allow Gradle to continue to the next repository, and an unresolvable host name could let an attacker register a service under the build’s host n...

CVE-2026-22816

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001591)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001591 advisory. A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flagTF bit in EFLAGS during emulation of the syscall instructio...

Dive code injection vulnerability

Dive is a desktop application for MCP hosts, open-sourced by OpenAgentPlatform. Versions of Dive prior to 0.13.0 contained a code injection vulnerability. This vulnerability stemmed from specially crafted deep links that allowed the installation of MCP server configurations controlled by attacker...

CVE-2026-0734

The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-0734

The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-2524

The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-0734 WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter

The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-0734 WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter

The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...