CVE-2026-85588

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

EUVD-2026-71011

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

Malicious code in ctech-shared (npm)

The package ctech-shared was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in claims-shared (npm)

Source: amazon-inspector 234e56b5a35fe88da0e1c1618cfa81e163b8a959d3c5b2e50b8de8bee67b6404 On require of claims-shared, index.js loads polyfill.js whose top-level start unconditionally fetches a platform-specific binary from a shuffled list of runtime-assembled Cloudflare Workers hosts...

Malicious code in claims-fixtures-shared (npm)

Source: amazon-inspector 291919ef20015ad326b92c506f2df9e710e72e659499bfd240c9b6453bf0fd82 On require'claims-fixtures-shared', index.js loads helpers.js which immediately calls init. init reconstructs four Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

Malicious code in claims-api-clients-shared (npm)

Source: amazon-inspector 95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86 [email protected] advertises itself as a REST client wrapper, but index.js unconditionally requires shim.js, whose main runs on load. On import, shim.js fetches a platform-specific binary over...

Malicious code in ciam-self-service-shared (npm)

The package ciam-self-service-shared was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cds-shared (npm)

--- Credit: OpenSSF source...

ROS-20260904-73-0008

The vulnerability in Kubernetes is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

...[ More ]

Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to unsafe loading and execution of untrusted shared libraries. When a user supplies a shared library path as a command-line argument, the application loads the library using dlopen and resolves an exported...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

PT-2026-86152

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...

Linux kernel Networking Function Heap Buffer Overflow DoS

The vulnerability of the inputprocesspayload function in the net/xfrm/xfrmiptfs.c module, which is part of the networking functions in the Linux kernel, is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow a remote attacker to...

Linux kernel vfiopci_core_close_device Heap Buffer Overflow DoS

The vulnerability of the vfiopcicoreclosedevice function in the drivers/vfio/pci/vfiopcicore.c module of the Linux kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

Linux kernel IPC DoS

The vulnerability in the shmtrydestroyorphaned function within the ipc/shm.c module of the Linux kernel’s inter-process communication subsystem is related to synchronization errors when using a shared resource “race condition”. Exploitation of this vulnerability may allow an attacker to cause a...

Linux net/unix/af_unix.c BPF Iteration DoS

The vulnerability of the bpfiterunixseqshow function in the net/unix/afunix.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...

Linux Distros Unpatched Vulnerability : CVE-2026-84933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In...

GHSA-H3HJ-CMCX-XC66 vulnerabilities

Vulnerabilities for packages: langfuse-fips, librechat, jitsucom-jitsu, langfuse, kibana, unleash-fips, unleash...

SUSE CVE-2026-74994

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...