CVE-2026-67214 nanoid before 5.1.16 Infinite Loop via Negative Size in non-secure module

nanoid Nano ID before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module nanoid/non-secure. When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning...

PT-2026-65852

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2026:3330-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3330-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: deni...

EUVD-2026-50079

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

EUVD-2026-49991

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058

Summary of CVE-2026-48058 (nebula-mesh) nebula-mesh (Slack Nebula mesh control plane) versions prior to 0.3.2 expose a cookie security flaw: internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on cookies but omit the Secure attribute. A plaintext HTTP request to the ori...

MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...

MAL-2026-11127 Malicious code in app-sima-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a34ad4e52b9e8255bcfa74cbb6aa18811b0c8d80819a75c6bbfc36d79757b66 The package's postinstall script performs three coordinated attacks against the installer at install time. First, on Linux it fetches an SSH public k...

CVE-2026-14103

An use after free flaw was found in the SSL component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513465245...

CVE-2026-18025

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example,...

erlang/otp: Erlang/OTP ssl client: Authentication bypass via unoffered anonymous cipher suite acceptance

A flaw was found in the Erlang/OTP ssl client. This vulnerability allows an on-path attacker to bypass server authentication in TLS 1.2 and earlier and DTLS connections. By tricking the client into accepting an unoffered anonymous cipher suite, the attacker can complete the handshake without a...

PT-2026-65623

Name of the Vulnerable Software and Affected Versions goshs versions 2.1.3 through 2.1.3 Description An authentication bypass exists in the SFTP server component when the application is started with a basic authentication string containing a username but an empty password e.g., -b 'admin:', the...

CVE-2026-66824

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

CVE-2026-64742

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

CVE-2026-64742

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

EUVD-2026-49469

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...