CVE-2026-108985

The libnfs library (versions through 6.0.2 before commit 7613236) is vulnerable to an out-of-bounds write during ZDR decoding. The issue originates in lib/libnfs-zdr.c within the libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array() functions because the caller-supplied maxsize value is...

EulerOS 2.0 SP13 : alsa-lib (EulerOS-SA-2026-4028)

According to the versions of the alsa-lib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows...

PT-2026-110447

Name of the Vulnerable Software and Affected Versions lib sag ai sound sep v2.00.so versions prior to SMR Oct-2026 Release 1 Description An out-of-bounds read and write issue exists in the lib sag ai sound sep v2.00.so library. This flaw allows local attackers to read and write memory outside the...

CVE-2026-108985: Out-of-bounds Write

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes, libnfszdrstring, and libnfszdrarray. The caller-supplied maxsize value is not honored...

CVE-2026-109332: Origin Validation Error

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

Malicious code in nested-lib (npm)

Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a JSON payload containing os.hostname, dirname, process.cwd,...

MAL-2026-17773 Malicious code in nested-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a...

MAL-2026-17790 Malicious code in mev-sandwich-detect (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d92e0d32c64cdab1627cbfe5bd1d79445d0ff09f4d24336dd9026c02fe46917 mev-sandwich-detect 0.9.1 is a stub gem whose only functional behavior is install-time code execution. The gemspec declares a native extension, but...

MAL-2026-17795 Malicious code in sol-mint-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2940bc600ade9f91afdc44ccc04cdab589d276b0504b3f12ffb4a4e827920bd9 The gem ships a native-extension stub extconf.rb that gem install executes automatically, but no C/C++ sources accompany it and lib/solmintutils.rb i...

MAL-2026-17864 Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

MAL-2026-17865 Malicious code in passwordcrackv2 (npm)

passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

PT-2026-108772

Name of the Vulnerable Software and Affected Versions elixir-protobuf versions 0.8.0 through 0.17.0 Description An unauthenticated remote attacker can cause a crash of the decoding process by providing a deeply nested JSON document. This occurs when an application decodes attacker-supplied JSON...

CVE-2026-107608

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

GHSA-53V6-4H7P-P4GJ music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

cloud.pianola:cdk-fluent-assertions (>=1.0.0, <=1.0.1), com.cloudcamphq:aws-runtime (0.0.1) +781 more potentially affected by CVE-2026-107608 via software.amazon.awscdk:aws-cdk-lib (>=2.0.0-rc.27, <=2.266.0)

software.amazon.awscdk:aws-cdk-lib MAVEN version =2.0.0-rc.27, =1.0.0, =1.0.8, =1.0.8, =1.0.8, =1.0.8, =1.0.8, =2.0.0 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-107608...

CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

apus-cli (0.0.21), asaas-cdk-constructs (0.1.0) +183 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0, <=2.260.0)

aws-cdk-lib PYPI version =2.0.0, =0.0.1, =0.0.3, =2.6.4, =2.82.0a0, =0.0.0, =2.73.0a0, =2.73.0a0, =2.73.0a0, =2.73.0a0, =2.91.0a0, =2.73.0a0, =2.73.0a0, =2.95.1a0 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-107608...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +629 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0-rc.4, <=2.266.0)

aws-cdk-lib NPM version =2.0.0-rc.4, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-10760...