CVE-2026-73232: Improper Handling of Highly Compressed Data (Data Amplification)

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-72582: NULL Pointer Dereference

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

PT-2026-69467

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2 Description A stored cross-site scripting XSS issue exists where a low-privileged authenticated user can upload an SVG file containing malicious JavaScript. This occurs because the PutMultipart function in...

PT-2026-69469

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 13.2.1 Description An authorization bypass allows a user with the Editor role to delete protected contact points receivers without possessing the necessary alert.notifications.receivers.protected:write permission. Thi...

The vulnerability of the nameAndService() function in the pkg/provider/kubernetes/crd/kubernetes_http.go file, a provider for integrating with the Kubernetes CRD of the reverse proxy server Containous Traefik, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the nameAndService function in the pkg/provider/kubernetes/crd/kuberneteshttp.go file, which is part of the integration provider for Kubernetes’ CRD reverse proxy server Containous Traefik, is related to insufficient spatial partitioning. Exploiting this vulnerability could...

CVE-2026-71326

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-13075 Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-13076 Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

Malicious code in devpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...

PT-2026-68064

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The endpoint '/v3/import/token clusterId.yaml' retrieves the cluster object before validating the token. A nil pointer dereference occurs in...

CVE-2026-55998: Observable Response Discrepancy

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-71208: Server-Side Request Forgery (SSRF)

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-44945: Unintended Proxy or Intermediary

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

CVE-2026-18593: Undefined Security Weakness

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

Malicious Package

Overview hello-world-pkg-value-value-p is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview agentsync-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview test-pkg-x0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview test-pkg-yarn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the exec request handling process. An attacker can cause the server process to crash and terminate all active connections by sending a specially crafted five-byte message with a manipulated length field...