MAL-2026-18517 Malicious code in @atedone/workspace-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe On require, the package's top-level state.initialize writes shell integration files into /.config/workspace-context init.zsh,.zshrc,...

Malicious code in @atedone/workspace-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe On require, the package's top-level state.initialize writes shell integration files into /.config/workspace-context init.zsh,.zshrc,...

openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:22195-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22195-1 advisory. Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently...

SUSE CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...

CVE-2026-114729

A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics SVG animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote...

Linux Distros Unpatched Vulnerability : CVE-2026-118174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sende...

DEBIAN-CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

UBUNTU-CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

CVE-2026-118174 Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

EUVD-2026-111351

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

PT-2026-127203

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description Thunderbird automatically loads the content of OpenPGP key attachments to facilitate key importing. A sender can mark such an attachment as an external attachmen...

Mozilla Thunderbird security vulnerabilities

Versions prior to 159 and 153.6 of Mozilla Thunderbird contain a security vulnerability. This vulnerability arises because messages containing OpenPGP key attachments are automatically loaded, without any restrictions on marking such attachments as external files pointing to arbitrary URLs. As a...

CVE-2026-118174: Undefined Security Weakness

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

DEBIAN-CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114729

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes to, from and values for URIs, but not by; so markup such as in an HTML message caused remote content to be loaded without the user's...

CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

DEBIAN-CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...