Linux Distros Unpatched Vulnerability : CVE-2026-71851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom...

Ruby oj Gem < 3.17.3 Multiple Vulnerabilities

The version of the oj Ruby gem installed on the remote host is prior to 3.17.3. It is, therefore, affected by multiple vulnerabilities: - Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS...

Ruby JSON - JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...

Linux Distros Unpatched Vulnerability : CVE-2026-71847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but...

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-48088

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

GHSA-957R-QF9P-67XW Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

EUVD-2026-54174

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

CVE-2026-70559 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

Malicious code in zyr-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at...

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector o...

Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

MAL-2026-13472 Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...

Malicious code in alphalend-layouts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...