Malicious code in relion-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650bf9452e7eaed5b89edb5f2af6208d4491aa079a90805fd6360b32ee6ff6d8 The package relion-chain was found to contain malicious code...

MAL-2026-2788 Malicious code in otomi-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f9238b0645d7de5b5df1ba2ccc3d6a6d2d476b29cfd3a7eaa583ec4c32c7839 The package otomi-console was found to contain malicious code...

MAL-2026-2785 Malicious code in nemo-jaws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a52b0aca2f522f9d9ab39b1b2ddf4f16b0e2d5c40b796392848c3a3ac77e73fa On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir, and...

MAL-2026-2773 Malicious code in insomnia-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ef28a051caf1396ddc2679da2de7e5ee5786101e51a8b3b01cab3c68b60235 The package insomnia-api was found to contain malicious code...

Malicious code in farikku-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f74e79e5f35cd4e3f49a89dc7e0c244bdd40466a158c84cf45b61bb23553bd27 The package farikku-util was found to contain malicious code...

MAL-2026-2713 Malicious code in @fuego-tools/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b13e975286ea5f50f12e176e5b9399e209b890fc03e8d5f890f02d83a52489 The package @fuego-tools/analytics was found to contain malicious code...

Malicious code in @3stripes/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca39203b484afe25fca27596d3c3c81a0a6765ad88d3b129871375127bdb5ea The package @3stripes/shared was found to contain malicious code...

WordPress Barcode Scanner (+Mobile App) plugin <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication vulnerability

Unauthenticated Privilege Escalation via Insecure Token Authentication vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.11.0...

SUSE CVE-2026-3392

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function evaltree of the file src/lilyemitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could ...

SUSE-SU-2026:1378-1 Security update for kea

This update for kea fixes the following issues: Update to release 2.6.5: A large number of bracket pairs in a JSON payload directed to any endpoint would result in a stack overflow, due to recursive calls when parsing the JSON. This has been fixed. CVE-2026-3608 bsc1260380 A null dereference is n...

K000160829: Apache HTTP Server Vulnerabilities CVE-2025-55753, CVE-2025-58098, CVE-2025-59775

Security Advisory Description CVE-2025-55753 An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeed...

UBUNTU-CVE-2026-40962

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

GHSA-6F54-QJVM-WWQ3 wger has Stored XSS via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attributionlink property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields licenseauthor, licensetitle, licenseobjecturl, licenseauthorurl, licensederivativesourceur...

CVE-2026-40962

FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC Common Encryption subsample data to libavformat/mov.c...

Exploit for Incorrect Permission Assignment for Critical Resource in Facebook Below

CVE-2025-27591 — Meta below Symlink Local Privilege Escalati...

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

Summary The Froxlor API endpoint Customers.update and Admins.update does not validate the deflanguage parameter against the list of available language files. An authenticated customer can set deflanguage to a path traversal payload e.g., ../../../../../var/customers/webs/customer1/evil, which is...

CVE-2026-40316

creationtimestamp| type| source ---|---|--- 2026-04-16 00:58:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjl7dv32lv2x 2026-04-16 14:05:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmlcxb6k72h 2026-04-17 17:31:16+00:00| seen|...

CVE-2026-40959

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod...

.NET 9.0 security update

9.0.116-1.0.1 - Add support for Oracle Linux 9.0.116-1 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163394...

AlmaLinux 8 : bind (ALSA-2026:8352)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:8352 advisory. bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block directly from the...