MAL-2026-11164 Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11167 Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11166 Malicious code in lib-mtop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1dad2a69d97f4f14b77fdb334f860745feac703828131718a950a54b2d7cece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11165 Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-51296

A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information...

CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-66299

Apache Tomcat is vulnerable to an uncontrolled resource consumption vulnerability within its WebSocket chat example . This issue impacts versions 11.0.0-M20 through 11.0.24 , 10.1.24 through 10.1.57 , and 9.0.89 through 9.0.120 . The vulnerability can lead to a Denial of Service (DoS) . Users who...

CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

EUVD-2026-49852

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

Apache Tomcat 10.1.24 < 10.1.58

The version of Tomcat installed on the remote host is prior to 10.1.58. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.58security-10 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affect...

PT-2026-65500

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521: Improper Limitation of a Pathname to a Restricted Directory

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

The vulnerabilities of the functions aml_rtc_probe() and aml_rtc_remove() in the driver module drivers/rtc/rtc-amlogic-a4.c of the Real Time Clock driver in the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions amlrtcprobe and amlrtcremove in the driver module drivers/rtc/rtc-amlogic-a4.c of the Real Time Clock driver in the Linux operating system is related to the repeated release of previously released memory. Exploiting this vulnerability could allow a remote attack...