MAL-2026-11072 Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: floci, kafbat-ui, strimzi-kafka-operator-fips, debezium, apicurio-registry, spark, logstash, opensearch, pinot-fips, spark-kubernetes-operator-fips, dd-trace-java, cassandra-reaper, confluent-kafka, opensearch-fips, traccar-fips, dependency-track-apiserver,...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: floci, kafbat-ui, strimzi-kafka-operator-fips, debezium, apicurio-registry, spark, logstash, opensearch, pinot-fips, spark-kubernetes-operator-fips, dd-trace-java, cassandra-reaper, confluent-kafka, opensearch-fips, traccar-fips, dependency-track-apiserver,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, flux-notification-controller-fips, open-cluster-management-fips, cloud-provider-aws-fips, keda-fips, envoy-ai-gateway-fips, kubernetes-csi-external-resizer, ceph-csi-operator-fips, crossplane-provider-kubernetes, azure-service-operator-fips...

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

The operators of the DevMan ransomware-as-a-service RaaS scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administere...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

🚀 CVE-2026-31431 – Advanced Linux Kernel Exploit "From...

JLSEC-2026-795 Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash...

Linux Distros Unpatched Vulnerability : CVE-2026-65904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's...

Linux Distros Unpatched Vulnerability : CVE-2026-56746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

GHSA-FP43-VJ7G-PG92 OmniFaces: Forged combined-resource IDs and related output/push boundaries

Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

GHSA-F25V-X6VR-962G Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...