MAL-2026-17310 Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...

CLEANSTART-2026-HJ64426 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-BY71452 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

CVE-2026-92173: Undefined Security Weakness

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

PT-2026-103605

Name of the Vulnerable Software and Affected Versions Meta Horizon OS versions prior to 66.0.0.733.524 Description OVRMediaService can be induced to send a privileged PendingIntent containing a com.oculus.horizon CallerIdentity to any application that registers for...

The vulnerability of the compatibility package for Microsoft Azure Entra ID lies in insufficient validation of requests on the server side, allowing attackers to escalate their privileges.

The vulnerability of the compatibility package for Microsoft Azure Entra ID is related to insufficient validation of requests at the server-side. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

PT-2026-103534

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...

CVE-2026-102096: Improper Neutralization of Special Elements used in an OS Command

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

AlmaLinux 9.2 [TuxCare] Security Update: edk2-aarch64 / edk2-ovmf / edk2-tools / edk2-tools-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763716672)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763716672 advisory. - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6...

AlmaLinux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1789376503)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789376503 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1782991913)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782991913 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2026:1784074875)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784074875 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1784533387)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784533387 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

Rocky Linux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1789376503)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789376503 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102830

A vulnerability in JupyterLab (versions 3.0.0 through 4.5.11 and 4.6.4) and JupyterLite Core (0.8.3 and earlier) allows for the execution of arbitrary JavaScript. The root cause is a prefix-only regular-expression validation in the Plural-Forms header of certain third-party language packs, which ...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2064 more potentially affected by CVE-2026-85008 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-85008 Source advisory: OSV:GHSA-8436-99HF-9MMV...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +30 more potentially affected by CVE-2026-102676 via electron (>=43.0.0, <=43.4.0)

electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.208, =1.3.9 and more Source cves: CVE-2026-102676 Source advisory: SNYK:JS-ELECTRON-20335447...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +35 more potentially affected by CVE-2026-102677 via electron (>=43.0.0, <=43.4.1)

electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 - @sharpcaterpillar/pi-web 0.8.11 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

GHSA-P9F8-WVJ8-2FG8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...