CVE-2026-74708

CVE-2026-74708 is a Linux kernel vulnerability in the AF_XDP (xsk) subsystem. Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata, and the kernel failed to validate that the registered metadata area contained the complete field. The fix rejects the request when the me...

preflight v0.20.1

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

Security Bulletin:Vulnerability in Vite affects IBM Netezza Appliance

Summary The Vite package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-53571, CVE-2026-53632 Vulnerability Details CVEID:CVE-2026-53571 DESCRIPTION: Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

PT-2026-69401

Name of the Vulnerable Software and Affected Versions Galaxy Themes versions prior to SMR Aug-2026 Release 1 Description Improper input validation allows physical attackers to launch arbitrary activity. Recommendations Update Galaxy Themes to SMR Aug-2026 Release 1...

CVE-2026-68081

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-71319

Nuxt DevTools prior to version 3.3.1 exposes an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket (ws://:/, subprotocol vite-hmr). The channel, via plugin nuxt:devtools:rpc, allows calling RPC methods without token/handshake/origin checks; updateOptions(), clearOptions(), and ...

Incorrect Permission Assignment for Critical Resource

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the openExternal. An attacker can cause an...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-13328 Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in @cy4dev/cydemo-bg-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exe...

Malicious code in streak-count-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

CVE-2026-70612: Improper Access Control

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-69259

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327

CVE-2026-59327 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue is that the Spring Boot DevTools remote secret (spring.devtools.remote.secret) is stored as a plain string attribute on the "Spring Boot DevTools Client" launch configuration and persisted as cleartext XML, either in w...