1164675 matches found
rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection
A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...
EUVD-2026-89959
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-101295
The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...
CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...
CVE-2026-101295
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...
Malicious code in reactjs-risk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...
MAL-2026-17339 Malicious code in reactjs-risk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...
Malicious code in apl-rive-renderer (npm)
apl-rive-renderer is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...
MAL-2026-17431 Malicious code in apl-rive-renderer (npm)
apl-rive-renderer is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, working...
Malicious code in cortana-md-engine (npm)
Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
Cyberary-AI
🛡️ CYBERARY-AI: Autonomous Cyber Defense & Offensive Operation...
Malicious code in cortana-md-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
MAL-2026-17323 Malicious code in cortana-md-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
CVE-2026-96649
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...
CVE-2026-68497 vulnerabilities
Vulnerabilities for packages: ruby3.2-jrjackson, ruby3.4-jrjackson, kafka, wavefront-proxy, thingsboard, strimzi-kafka-operator, ruby4.0-jrjackson, akhq, kserve-modelmesh, druid, spark, opensearch, confluent-kafka, zipkin, cassandra, strimzi-kafka-oauth, wildfly, apicurio-registry,...
GHSA-WJGM-6HV5-3CVF vulnerabilities
Vulnerabilities for packages: ruby3.2-jrjackson, ruby3.4-jrjackson, kafka, wavefront-proxy, thingsboard, strimzi-kafka-operator, ruby4.0-jrjackson, akhq, kserve-modelmesh, druid, spark, opensearch, confluent-kafka, zipkin, cassandra, strimzi-kafka-oauth, wildfly, apicurio-registry,...
GHSA-GX83-3VF8-GH7J vulnerabilities
Vulnerabilities for packages: ruby3.2-jrjackson, ruby3.4-jrjackson, kafka, wavefront-proxy, thingsboard, strimzi-kafka-operator, ruby4.0-jrjackson, akhq, kserve-modelmesh, druid, spark, opensearch, confluent-kafka, zipkin, cassandra, strimzi-kafka-oauth, wildfly, apicurio-registry,...