MAL-2026-10749 Malicious code in sync-grove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65248cd6e2924b6485824bcf382441e39d5e09860bc1e849aee0d6d289d184fb Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exe...

CVE-2026-39832

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

CVE-2026-34148

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or...

EUVD-2025-201100

Envoy crashes when JWT authentication is configured with the remote JWKS fetching...

LURK-T: Limited Use of Remote Keys with Added Trust in TLS 1.3

In many web applications, such as Content Delivery Networks CDNs, TLS credentials are shared, e.g., between the website's TLS origin server and the CDN's edge servers, which can be distributed around the globe. To enhance the security and trust for TLS 1.3 in such scenarios, we propose LURK-T, a...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...

Elasticsearch 安全漏洞

Elasticsearch is a search engine based on the Lucene library. A security vulnerability exists in Elasticsearch versions prior to 8.13.0 that stems from an incorrect authorization issue in the API key-based security model, allowing an attacker with a remote cluster API key to read arbitrary...

UVI-2021-1000525 Bluetooth: SMP: Fail if remote and local public keys are identical

Bluetooth: SMP: Fail if remote and local public keys are identical This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.234 by commit...

GSD-2021-1000524 Bluetooth: SMP: Fail if remote and local public keys are identical

Bluetooth: SMP: Fail if remote and local public keys are identical This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.192 by commit...