K000163001: NLnet Labs Unbound vulnerability CVE-2026-42923

Security Advisory Description NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to...

vuln-labs-angara

vuln-labs-angara Семь независимых Docker-стендов с уязвимыми...

Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...

MAL-2026-14368 Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...

Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

MAL-2026-14369 Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

MAL-2026-14367 Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability

Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...

CVE-2026-74253 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

exp-labs

exp-labs Cybersecurity Training Platform This modern web secu...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000162865)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5 / 17.1.5.9 / 21.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K000162865 advisory. NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability...

Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

MAL-2026-13714 Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

CVE-2026-72588 bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

EUVD-2026-55218

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

CVE-2026-72588

Summary : CVE-2026-72588 affects bluewave-labs/Checkmate up to version 2.1.0. The vulnerability resides in the password-recovery endpoint /api/v1/auth/recovery/request, where an unauthenticated attacker can determine if an email is registered by observing differing HTTP responses (HTTP 200 for re...

CVE-2026-18998

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...