CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)

Last week, there were 91 vulnerabilities disclosed in WordPress Core, 80 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: A Denia...

A New Threat Landscape Meets A New Kind of Defender

Three years ago we launched a bug bounty program to accelerate WordPress security research, and it has been incredibly successful and has since secured the WordPress community against 9,727 vulnerabilities reported through our program. We have thus far awarded a total of $981,251 to researchers...

CVE-2026-15615

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

The case for a cooldown: Why Dependabot now waits before issuing version updates

In September 2025, an attacker phished the credentials of a single npm maintainer and published booby-trapped versions of chalk, debug, and around a dozen other packages that are together downloaded more than 2 billion times a week. The code rewrote cryptocurrency wallet addresses inside any...

Improper Check for Unusual or Exceptional Conditions

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe's...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15615

Technical details about CVE-2026-15615 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

EUVD-2026-48302

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

Malicious Package

Overview streak-lib-math is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11036 Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c The package advertises pure calendar/streak math but its main entry index.mjs schedules an async routine on module import via...

MAL-2026-11035 Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c The package advertises pure calendar/streak math but its main entry index.mjs schedules an async routine on module import via...

JLSEC-2026-784

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may ...