Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nfsd: Do not replace a page in the rqpages array if it is a continuation of the last page. The splice read function calls nfsdspliceactor to place the pages containing file data into the svcrqst-rqpages array. However, it is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Net: Marvell: Pestera: Fixed handling of IPv4 routes with nhid. Fixed the handling of IPv4 routes that reference a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. When attempting to add an IPv4 route that...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: schhtb: Made htbdeactivate idempotent. Alan reported a NULL pointer dereference in htbnextrbnode after we made htbqlennotify idempotent. It turns out that in the following case, some regressions were introduced: htbdequeuetree...

Prototype Pollution

Overview @alifd/next is an A configurable component library for web built on React. Affected versions of this package are vulnerable to Prototype Pollution due to the ConfigProvider.getContextProps function in components/dialog/index.tsx. An attacker can modify object prototype attributes by...

@ablula/blog-jinchan (>=0.0.1, <=0.0.9), @ablula/default-blog-theme (>=0.0.1, <=0.0.6) +10958 more potentially affected by CVE-2026-78180 via @alifd/next (>=1.9.23, <=1.27.34)

@alifd/next NPM version =1.9.23, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =0.0.2, =0.0.1, =0.1.5 and more Source cves: CVE-2026-78180 Source advisory: SNYK:JS-ALIFDNEXT-19233840...

CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

EUVD-2026-64702

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180

alibaba-fusion next (up to version 1.27.34) is affected by a prototype pollution vulnerability in the deepMerge component, specifically in the ConfigProvider.getContextProps function within components/dialog/index.tsx. By manipulating the locale argument, an attacker can improperly control object...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

EUVD-2026-64670

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

PT-2026-79815

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78145

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145: URL Redirection to Untrusted Site

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

PT-2026-79787

Name of the Vulnerable Software and Affected Versions CTFd versions prior to 3.8.5 Description An open redirect issue exists where remote attackers can manipulate the Next argument. This occurs within the is safe url function located in the CTFd/utils/validators/ init .py file. Recommendations...

Malicious Package

Overview @next-fonts/font is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-14346 Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...