Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

SUSE-SU-2026:3362-1 Security update for samba

This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-byt...

Apache Struts 2 - Remote Command Execution Detection

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...

OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...

CVE-2026-59922

A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs tilde, equals-sign, or caret. This crafted input causes the parser to perform quadratic work, leading to excessive CPU...

CVE-2026-59924

A flaw was found in Mistune, a Python Markdown parser. The Include.parse function does not properly verify user-supplied include paths, allowing an attacker to craft paths that can access files outside the intended markdown directory. This can lead to information disclosure when markdown files ar...

CVE-2026-51274

...

CVE-2026-51274

The CVE-2026-51274 entry relates to the schreibfaul1 ESP32-audioI2S 3.4.5 stack, where the heap-based buffer overflow occurs in the ID3v2 SYLT synchronized lyrics parser in audiolib. Root cause: missing bounds validation on attacker-controlled frame size and improper memory access during lyric pa...

PT-2026-65533

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...

CVE-2026-51274

...

CVE-2026-51274

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

dovecot security update

1:2.3.16-8 - fix CVE-2026-42006: fix IMAP parser listcountlimit to correctly limit open braces instead of close braces RHEL-188480...

EUVD-2026-49927

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...

CVE-2026-54690: Server-Side Request Forgery (SSRF)

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

TencentOS Server 3: python3 (TSSA-2026:0766)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0766 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 2: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (TSSA-2026:0765)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0765 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

SUSE SLES16 Security Update : perl-DBI (SUSE-SU-2026:22845-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22845-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes...

SUSE SLES16 Security Update : joe (SUSE-SU-2026:22843-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22843-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command...

cookie-parser-es (>=1.0.7, <=1.0.8) potentially affected by unknown CVE via set-cookie-ease (1.1.5)

set-cookie-ease NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on set-cookie-ease and may be impacted: - cookie-parser-es =1.0.7, =1.0.8 Source cves: unknown CVE Source advisory: GHSA-9CVH-X7WF-82V8...

CVE-2026-66729

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...