Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37180e79a740fa9d241365c18f742062d7f75c0401e536597a884659019104b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14507 Malicious code in foldmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9cca1d03abe7ef289ed4020764e89aa4121813d9677c9917068cf5949a5f7ee4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14508 Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37180e79a740fa9d241365c18f742062d7f75c0401e536597a884659019104b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in snapbuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d269e13beb177fdcd2bb5a71639f181a6b22dafb2f954a5c63cd76aed48f74aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14510 Malicious code in snapbuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d269e13beb177fdcd2bb5a71639f181a6b22dafb2f954a5c63cd76aed48f74aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

USN-8676-1: OpenJDK 17 vulnerabilities

It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attack...

USN-8676-1 openjdk-17 vulnerabilities

It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attack...

CVE-2026-64203 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 26.3.0 and...

EUVD-2026-65592

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 26.3.0 and...

CVE-2026-64203 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 26.3.0 and...

CVE-2026-64203

CVE-2026-64203 is a memory corruption vulnerability (specifically an out-of-bounds read ) in NI LabVIEW triggered when loading a VI. Successful exploitation requires an attacker to get a user to open a specially crafted VI , which may lead to information disclosure or arbitrary code execution . T...

Malicious code in dim-svelte-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfce07434dcbe4a2c45d6b3008ad6bdd6bb6a94781f028ed168afee7df13fff8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14506 Malicious code in dim-svelte-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfce07434dcbe4a2c45d6b3008ad6bdd6bb6a94781f028ed168afee7df13fff8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

Malicious code in svelte-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9320122ff01bf30c3bd8f4dfb1f84ff1f83fc40e1c0f0e945ca75823c79b810 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14511 Malicious code in svelte-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9320122ff01bf30c3bd8f4dfb1f84ff1f83fc40e1c0f0e945ca75823c79b810 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

DEBIAN-CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

DEBIAN-CVE-2026-56703

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...