EUVD-2026-94531

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks...

MAL-2026-17684 Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for python-hpack

This update for python-hpack fixes the following issue: CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:4593-1 Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035...

cve-2019-5736-poc

CVE-2019-5736 Prueba de Concepto Esto agrega una cadena al binario runc del host. Trae tu propio payload ver stage2.c. Para ejecutar: docker build -t cve . docker run cve strings /usr/bin/docker-runc | tail -n 2...

Malicious Package

Overview dotenv-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-gyp-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

CVE-2026-107324: Integer Overflow or Wraparound

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

CVE-2026-107325: Improper Validation of Array Index

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

Linux Distros Unpatched Vulnerability : CVE-2026-98310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk wal...

PT-2026-108144

Name of the Vulnerable Software and Affected Versions MongoDB Go Driver affected versions not specified Description Improper validation of a BSON array length can lead to an out-of-bounds index and runtime panic. This occurs when an application invokes the bson.RawArray.Validate or...

GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

CVE-2026-107214

The Excelize Go language library (versions 2.3.1 to 2.11.0 ) contains a vulnerability where the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors process attacker-controlled values. Specifically, EncryptionInfo and EncryptedPackage ...

CVE-2026-106558

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CLSA-2026-1791333440 expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...