Malicious code in log-rotate-testmetest (npm)

Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time...

Malicious code in log-rotate-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...

Astra Linux – Vulnerability in TIF format

Libtiff 4.5.0 is vulnerable to a Buffer Overflow issue through /libtiff/tools/tiffcrop.c:8499. Incorrect updates to the buffer size after the rotateImage function in tiffcrop cause a Heap-Buffer-Overflow and Segmentation Fault...

CVE-2026-110622

The Papermerge Core software (through version 3.5.3 ) is vulnerable to a missing authorization flaw in its page management and OCR endpoints. The root cause is that these endpoints fail to perform necessary has_node_perm checks, allowing authenticated users to access and manipulate data belonging...

CVE-2026-110622 Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

CVE-2026-110622: Missing Authorization

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

CVE-2026-73445

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

EUVD-2026-80317

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73447 Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary...

CVE-2026-73447 Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary...

CVE-2026-73445: Improper Input Validation

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

PT-2026-93326

Name of the Vulnerable Software and Affected Versions Arista EOS-based products affected versions not specified Description An authenticated user can escalate privileges to root and execute arbitrary OS commands by sending a crafted Certz Rotate request to the gRPC Network Security Interface gNSI...

PT-2026-93399

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description An issue exists within the gRPC Network Security Interface gNSI Authz Rotate RPC that may allow an incorrect Authz policy, uploaded during an ongoing RPC stream, to become active. This iss...

PT-2026-96479

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

Security Advisory 0167

Security Advisory 0167 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73445 CVSSv3.1 Base Score: 4.9...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...