CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

ironclaw ironclaw-v1.1.0-rc.1

IronClaw Your secure personal AI assistant, always on your side English | 简体中文 | Русский | 日本語 | 한국어 Reborn Quick Start • Philosophy • Features • Installation • Configuration • Security • Architecture IronClaw Reborn Quick Start IronClaw Reborn is the standalone runtime on the reborn-integration...

sandbox-runtime v0.0.70

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

MAL-2026-12045 Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

Malicious code in bigops-chat-tmsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...

CVE-2026-66298: Origin Validation Error

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

CVE-2026-67869

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

PT-2026-68989

Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves // payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...

CVE-2026-71268: Improper Limitation of a Pathname to a Restricted Directory

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71316: Use of Cache Containing Sensitive Information

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for / /payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixe...

PT-2026-68141

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description The compile program function in webserver/openplc.py fails to validate the file path variable when parsing FILE:path content directives from uploaded Structured Text .st program files. This allows an...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Malicious code in eacq-payform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

GHSA-8R8H-6VCC-XHRV Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...

akto v2.16.5

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...