4268 matches found
PT-2026-96688
Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 Description Inefficient algorithmic complexity in the asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated...
PT-2026-96709
Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-054049)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054049 advisory. Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2023-002655)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002655 advisory. An issue was discovered in comparedigest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in...
PT-2026-96821
Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description In deployments where requests reach Next.js without the sanitizing custom-server.js wrapper, the application uses the client-supplied X-9r-Real-Ip header as the bucket key for rate limiting. This...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090113)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090113 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks...
CVE-2026-78847
An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...
MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...
Malicious code in @uol-afiliados/affiliated-config-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...
Reliance on Untrusted Inputs in a Security Decision
Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...
Malicious code in @baanx/solana-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...
MAL-2026-16300 Malicious code in @baanx/solana-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...
PT-2026-96030
Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...
CVE-2026-78847
All versions of gray-matter (verified on version 4.0.3 ) are vulnerable to arbitrary code execution. The flaw exists in the JavaScript engine located in lib/engines.js , where the application uses eval() to parse front matter when the language is set to js/javascript . While the documents do not ...
CVE-2026-94110: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...
CVE-2026-78847
An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...
CVE-2026-78847
An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...
CVE-2026-78847: Improper Neutralization of Directives in Dynamically Evaluated Code
An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...
PT-2026-96304
Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...
