Malicious code in beaver-ui-icon-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618 The package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomai...

MAL-2026-12156 Malicious code in bigops-chat-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8d11b7e8abee5caddc5c2f1765fa7f10d40c8cce0ef1cafed55fe31537be94 On require of bigops-chat-transfer, platform.js reconstructs one of three Cloudflare workers.dev hostnames from split string fragments...

CVE-2026-16604

The Passster (also known as Content Protector ) WordPress plugin versions prior to 4.3.6 is vulnerable to unauthenticated protected content disclosure . The root cause is that the plugin outputs password-protected block content in the public page response before performing password verification. ...

PT-2026-68073

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the IPv4 Forwarding Information Base FIB implementation. The fib table insert function adds a new fa object to the fa list using fib insert alias...

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

aistudio-scheduler-lock (>=1.0.0, <=1.0.5), autoreduce-db (>=22.0.0.dev7, <=22.0.0.dev11) +11 more potentially affected by CVE-2026-15307 via django (3.2.6)

django PYPI version 3.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aistudio-scheduler-lock =1.0.0, =22.0.0.dev7, =22.0.0.dev7, =22.0.0.dev14, =0.0.1, =2.2.2, =0.1.0, =0.0.1, =1.0.0 - schedulerlock 0.1.4 - terra-cola...

aimmo (>=2.7.1, <=2.9.0), aistudio-scheduler-lock (>=1.0.6a1, <=1.0.6) +23 more potentially affected by CVE-2026-15830 via django (3.2.19)

django PYPI version 3.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =2.7.1, =1.0.6a1, =0.1.28, =6.30.5, =6.30.5, =0.105.0rc2, =0.106.0 - grimoire-elk-public-inbox 0.1.0 and more Source cves: CVE-2026-15830...

aistudio-scheduler-lock (>=1.0.0, <=1.0.5), autoreduce-db (>=22.0.0.dev7, <=22.0.0.dev11) +11 more potentially affected by CVE-2026-15830 via django (3.2.6)

django PYPI version 3.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aistudio-scheduler-lock =1.0.0, =22.0.0.dev7, =22.0.0.dev7, =22.0.0.dev14, =0.0.1, =2.2.2, =0.1.0, =0.0.1, =1.0.0 - schedulerlock 0.1.4 - terra-cola...

kernel: procfs: avoid fetching build ID while holding VMA lock

A deadlock vulnerability was found in the procfs PROCMAPQUERY ioctl handler. When fetching the optional build ID while holding the VMA lock mmaplock, a circular lock dependency can occur with the inode mutex, causing a system deadlock...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix...

ALSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...

SUSE CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

AZL-94517 CVE-2026-18651 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

UBUNTU-CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

EUVD-2026-52328

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-18651 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...