Malicious code in base65-85x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d94610a3e8258b4f3f141cda2ade7a2bdeafbf9f8c1a9251d72c8b0c6dd4cff0 Package name base65-85x impersonates the widely-used base-x encoding library, with package.json copying base-x's homepage, bugs.url, and repository.u...

CVE-2026-49090

CVE-2026-49090 affects Elasticsearch and is caused by Uncontrolled Resource Consumption (CWE-400) via the bulk API, where an authenticated user can submit specially crafted bulk requests that trigger sustained high CPU and can render a node unresponsive. The issue is publicly discussed in Elastic...

MAL-2026-6703 Malicious code in @andes-tools/colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eaa7ebbb428747d4b9b5ef497dd78f0bfe55f843a9ae526feaf96a788f4abdfb The OpenSSF Package Analysis project identified '@andes-tools/colors' @ 999.0.0 npm as malicious. It is considered malicious because: - The...

CVE-2026-56148

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable...

CVE-2026-53353

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

CVE-2026-53353

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

UBUNTU-CVE-2026-53353

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

EUVD-2026-40987

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

CVE-2026-53353

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

CVE-2026-53353

CVE-2026-53353 affects the Linux kernel HSR code. The issue arises from a window where a device can be found but hsr->self_node is not set because of the ordering of dellink() and unregister_netdevice_many(), leading to a warning in hsr_addr_is_self() that is being removed. The fix removes WAR...

CVE-2026-53353 hsr: Remove WARN_ONCE() in hsr_addr_is_self().

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARNONCE in hsraddrisself. syzbot reported the warning 0 in hsraddrisself, whose assumption is simply wrong. hsr-selfnode is cleared in hsrdelselfnode, which is called from hsrdellink. Since dev-rtnllinkops-dellink is...

Uncaught Exception

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Uncaught Exception in the URL normalization process when handling malformed percent-encoded sequences in incoming request paths. An attacker can cause the Node.js process to terminate...

EUVD-2026-40947

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

ROOT-APP-NPM-CVE-2022-33987 CVE-2022-33987 in @rootio/got - Patched by Root

Root has patched CVE-2022-33987 in the @rootio/got package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-56018

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...

EUVD-2026-40453

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree AST security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module...

PT-2026-54638

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.2 Description An issue exists in the standalone engine's URL normalization and decoding process where malformed percent-encoded sequences in incoming request paths are not properly guarded...

Debian dla-4663 : libjs-lodash - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4663 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4663-1 [email protected]...

PT-2026-54821

In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARN ONCE in hsr addr is self. syzbot reported the warning 0 in hsr addr is self, whose assumption is simply wrong. hsr-self node is cleared in hsr del self node, which is called from hsr dellink. Since dev-rtnl link...

BIT-GHOST-2026-53948 Ghost: File Upload Content-Type Spoofing

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On...