Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1563 more potentially affected by CVE-2026-67313 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16499 more potentially affected by CVE-2026-67313 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

NPM: Axios: Prototype pollution auth subfields can inject Basic auth

NPM: Axios: Prototype pollution auth subfields can inject Basic auth vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.18.0...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16499 more potentially affected by CVE-2026-67312 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-67312 Source advisory: SNYK:JS-AXIOS-18060165...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1563 more potentially affected by CVE-2026-67312 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67312 Source advisory: SNYK:JS-AXIOS-18060165...

CVE-2026-35590

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

EUVD-2026-46002

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

CVE-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

EUVD-2026-45992

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: clear page-private in freepagesprepare CVE-2026-43303 In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks CVE-2026-45850 In the Linux...

Fedora 44 : wireshark (2026-bc152c9ff6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc152c9ff6 advisory. Latest wireshark version includes fixes for the following CVEs: CVE-2026-15163 CVE-2026-15164 CVE-2026-15165 CVE-2026-15166 CVE-2026-15167...

PT-2026-61635

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.2 Description The EXIF decoder fails to verify the range of EXIF tag groups before passing data to libexif. This lack of validation can lead to a null pointer dereference, which is a condition where the software...

CVE-2026-51385

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validateurl, safefetch, buildopener, fetchhtml and downloadbinary functions...

Linux Distros Unpatched Vulnerability : CVE-2026-63817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That...

PT-2026-61698

you don't need to overthink this 💡 an 11-byte TLS request can freeze server memory. that's the OpenSSL HollowByte vulnerability. here's what happened: a high-severity flaw CVE-2025-35588 discovered in OpenSSL versions 3.4.0, 3.3.0 to 3.3.3, 3.2.0… https://t.co/yXNb1p6oxS...

Linux Distros Unpatched Vulnerability : CVE-2026-64051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in...