GHSA-JFW3-2GCF-23R5 Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts...

GHSA-55P4-8J34-JV53 Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate...

Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts...

Malicious Package

Overview process-tailwind is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview process-lhpm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @biz44/process-runtime-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in process-tailwind (npm)

Source: amazon-inspector d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432 On require/import, index.js unconditionally calls initialize, which spawns a detached, unref'd node loader.js child with stdio ignored and writes a PID file. loader.js fetches JSON from...

Malicious code in process-lhpm (npm)

Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs an HTTPS GET to https://api.npoint.io/33e8d008c334b060adad...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

DEBIAN-CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-44163

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the inopentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability that arises from the failure to pass the PMD dirty bit to FIOL during the zap process, which may lead to silent data loss...

MAL-2026-16179 Malicious code in process-tailwind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432 On require/import, index.js unconditionally calls initialize, which spawns a detached, unref'd node loader.js child with stdio ignored and writes a P...

Malicious code in process-tailwind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d22d8ef47e17a005ea3305f7d97a3cb4de14f0a3a07e8a1e461e13d25e5e7432 On require/import, index.js unconditionally calls initialize, which spawns a detached, unref'd node loader.js child with stdio ignored and writes a P...

MAL-2026-16178 Malicious code in process-lhpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs ...

Malicious code in process-lhpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs ...

CVE-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...

SOC-Investigation-CVE-2024-49138

🛡️ Informe de Investigación SOC: Explotación de CVE-2024-49138 📌 Resumen Ejecutivo Título de la Alerta: SOC335 - Explotación de CVE-2024-49138 Detectada Severidad: Alta Host Objetivo: Victor 172.16.17.207 Sistema Operativo: Windows 10 Usuario Principal: letsdefend Veredicto: Positivo Verdadero...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91959 FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...