CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...

CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

CVE-2026-63133

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

EUVD-2026-56969

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

CVE-2026-63133

The Malcolm network traffic analysis tool suite is vulnerable to a denial-of-service (DoS) condition in versions prior to 26.07.0 . The safe-extract.py component extracts uploaded archives without limiting the entry count, directory depth, total entries, or output size. An attacker can provide a ...

CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

Malicious Package

Overview safe-local-env-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13741 Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

CVE-2026-72559

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

RUSTSEC-2026-0256 Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

Several methods in circular-buffer drop elements before updating the buffer's start/end metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer is later dropped or used after the panic ...

RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visit...

RUSTSEC-2026-0252 Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

SplitVec::extendfromslice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of those...

RUSTSEC-2026-0254 Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

Several methods in sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own...

Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

Several methods in sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own...

Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

Several methods in circular-buffer drop elements before updating the buffer's start/end metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer is later dropped or used after the panic ...

Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

Several methods in sized-chunks drop elements before updating the length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container's own Drop runs, those elements are visit...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-63133: Allocation of Resources Without Limits or Throttling

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...