Malicious code in chain-async-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b The package presents itself as a pino-compatible logger lib/ directory mirrors pino's internal file layout — proto.js, levels.js, redaction.js,...

Malicious code in chunk-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ffcc87316488b883c382ff45dd16c0bccb3cba432351f0716f239f81be79017 The package advertises itself as a 'Pure Node.js chunk parser platform' but its shipped code is a full remote-access trojan under internal identifier...

Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...

io.micronaut.aws:micronaut-aws-distributed-configuration (>=2.8.0, <=2.8.1), io.micronaut.aws:micronaut-aws-parameter-store (>=2.6.1, <=2.6.2) +10 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.4.2)

io.micronaut:micronaut-http-client MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.aws:micronaut-aws-distributed-configuration =2.8.0, =2.6.1, =2.6.1, =2.8.0,...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.4.0.m2, <=1.4.1), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.4.0.m2, <=1.4.1) +5 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.10)

io.micronaut:micronaut-http-client MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.4.0.m2, =1.4.0.m2, =1.4.0.m1, =1.4.1 ...

Security Bulletin: IBM i is Affected by Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime [CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007]

Summary IBM SDK Java Technology Edition and IBM Runtime Environment Java used by IBM i to support the building and running of Java applications are vulnerable to partial denial-of-service DoS CVE-2026-22021, CVE-2026-22018 and unauthorized access to data CVE-2026-22016, CVE-2026-22013,...

OESA-2026-2893 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

CLEANSTART-2026-TE85209 Security fixes for ghsa-m5vv-6r4h-3vj9 applied in versions: 0.12.0-r3

Security vulnerability affects the modelmesh-runtime-adapter package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-72137

Уязвимость файла src/runtime/server/og-image/context.ts модуля генерации Open Graph OG изображений Nuxt OG Image фреймворка для создания веб-приложений и сайтов Nuxt.js связана с загрузкой внешних ненадёжных данных вместе с надёжными данными. Эксплуатация уязвимости может позволить нарушителю,...

PT-2026-61065

Security vulnerability affects the modelmesh-runtime-adapter package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-59858: Improper Control of Generation of Code

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honor...

CVE-2026-59856: Improper Control of Generation of Code

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search pattern that is run via winexecute without escaping. A name...

PT-2026-56921

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...

Web Runtime Security Component Data Modification

The vulnerability of the Web Runtime Security component of the JD Edwards EnterpriseOne Tools system management tool for resources involves deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to modify, add, or delete dat...

Linux Distros Unpatched Vulnerability : CVE-2026-59937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause...

CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

Protecting Microsoft at AI speed: How SFI proactively hardens our cloud

AI models have reached a threshold where they exhibit expert-level capabilities in vulnerability discovery, exploit chaining, and proof-of-concept generation. As AI-powered vulnerability discovery matures, every organization that builds or runs software at scale needs continuous proactive...

Protecting Microsoft at AI speed: How SFI proactively hardens our cloud

AI models have reached a threshold where they exhibit expert-level capabilities in vulnerability discovery, exploit chaining, and proof-of-concept generation. As AI-powered vulnerability discovery matures, every organization that builds or runs software at scale needs continuous proactive...