MAL-2026-13495 Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54215

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

CVE-2026-54215

CVE-2026-54215 affects Tobit Laboratories AG TeamDavid’s Webbox (through Rollout 524). The vulnerability is an open redirect triggered by the replyUrl parameter, enabling an attacker to craft a URL that redirects users’ browsers to an arbitrary third-party site. This can be abused for phishing by...

EUVD-2026-54446

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

CVE-2026-54215 TeamDavid: Open Redirect via the 'replyUrl' parameter

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

EUVD-2026-54436

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-19079

A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...

CVE-2026-49005

The root password hash of the device can be obtained through unencrypted information in the firmware...

OESA-2026-3245 gimp security update

GIMP is a cross-platform image editor available for GNU/Linux, OS X, Windows and more operating systems. It is free software, you can change its source code and distribute your changes. Whether you are a graphic designer, photographer, illustrator, or scientist, GIMP provides you with sophisticat...

EUVD-2026-54290

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

EUVD-2026-54291

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

EUVD-2024-55712

The Class Mediator fails to correctly validate or sanitize messageContext properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the...

SUSE CVE-2026-42169

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

Linux Distros Unpatched Vulnerability : CVE-2026-18487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user click...

The vulnerability of the sss_nss_protocol_parse_addr() function in the NSS responder of the access control service for remote directories and the SSHD authentication mechanism allows a attacker to cause a service failure.

The vulnerability of the sssnssprotocolparseaddr function in the NSS responder component of the access control service for remote directories and the SSHD authentication mechanism is related to the issue of the operation being executed outside of the buffer. Exploiting this vulnerability could...

The vulnerability of Cisco IOS XE operating systems, related to insufficient control over resources during their existence, allows attackers to compromise the accessibility of protected information.

The vulnerability of Cisco IOS XE operating systems is related to insufficient control over resources during their existence. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...

Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has...