Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

MAL-2026-13721 Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

MAL-2026-13720 Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

Malicious code in commonjs-assertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...

CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

OPENSUSE-SU-2026:21550-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

SUSE-SU-2026:23050-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

EUVD-2026-55673

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-47754

CVE-2026-47754 affects Metacat 2.x (including 2.19.1) and all 1.x versions, with an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint. The bug stems from ArchiveHandler.readArchiveEntry() concatenating user input into a filesystem path and a disabled has...

CVE-2026-47754 unauthenticated path traversal in Metacat 2.x

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-47754 unauthenticated path traversal in Metacat 2.x

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...