pnpm has Path Traversal via arbitrary file permission modification

Summary When pnpm processes a package's directories.bin field, it uses path.join without validating the result stays within the package root. A malicious npm package can specify "directories": "bin": "../../../../tmp" to escape the package directory, causing pnpm to chmod 755 files at arbitrary...

ROS-20260126-73-0001

A vulnerability in the index.c component of the Linux operating system kernel is related to integer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-24404

creationtimestamp| type| source ---|---|--- 2026-01-24 03:24:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5bc77w5e2n...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2026:0218-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0218-1 advisory. Update to go1.25.6 released 2026-01-15 bsc1244485 Security fixes: - CVE-2025-61730: crypto/tls:...

Malicious code in h-jsencrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb69a1fb2f3c3ef16b7e30994095eb335b41563a498523667d83d60ed0c56c60 The package h-jsencrypt was found to contain malicious code. Source: ghsa-malware a2cacebaa99bf1715c395ba91c26e95c4ce77af5a16cbbcc4e5041c2a47b4143 An...

Malicious code in test-on-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaeca000a0d70bc52934cc2047e1924aa1f63f790734f0063a190476e7accdf2 The package test-on-other was found to contain malicious code...

CVE-2026-1299

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email foldin...

CVE-2025-3839

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...

Malicious code in oasis-os-provider-messaging (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cca1eb9a5a42a34b2db68e6d23c9c2cd2cbe7098f742e647c9c6867b342e95ab The package oasis-os-provider-messaging was found to contain malicious code...

EUVD-2026-4268

Gitea improperly exposes issue and pull request titles...

PT-2026-4293

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user may be able to modify the visibility settings of other users' OpenID identities due to improper ownership validation when toggling OpenID URI visibility. Recommendations A...

WordPress plugin xSmart has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-21943

creationtimestamp| type| source ---|---|--- 2026-01-21 08:23:53+00:00| seen| https://gist.github.com/Darkcrai86/9e07e2b9d2b4a7f979e9ed65b6569b80 2026-01-21 21:18:16+00:00| seen| https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875...

EUVD-2026-3710

Malicious code in ts-tweetnacl-utils npm...

EUVD-2026-3751

Malicious code in chai-chain-async npm...

EUVD-2026-3758

Malicious code in @mikudev/ridwan-signal npm...

CVE-2026-21990

...

CVE-2026-21987

CVE-2026-21987 affects Oracle VM VirtualBox (Core) with affected versions 7.1.14 and 7.2.4. The vulnerability is described as exploitable by a high‑privilege attacker who has logon to the infrastructure where VirtualBox runs, with local attack vector and impacts to confidentiality, integrity, and...

CVE-2026-21983

...

CVE-2026-21982

CVE-2026-21982 affects Oracle VM VirtualBox Core in the Oracle Virtualization product. Affected versions are 7.1.14 and 7.2.4. The issue allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running VirtualBox to compromise the software, pot...