@nx/powerpack-shared-fs-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2025-36852 +1 more via @nx/shared-fs-cache (>=5.0.0, <=5.0.7)

@nx/shared-fs-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2025-36852, CVE-2026-71476 Source advisory: GHSA-VP3H-GHGH-JR7G...

@nx/powerpack-shared-fs-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2025-36852 +1 more via @nx/shared-fs-cache (>=5.0.0, <=5.0.7)

@nx/shared-fs-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2025-36852, CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...

EUVD-2026-54224

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-64677

Anki’s local HTTP server (prior to version 25.09.3) is vulnerable to directory traversal via unconstrained media and built-in data paths. Attackers could leverage scripts served from shared decks or malicious sites with an origin-check bypass to read local files. The issue is fixed in 25.09.3. Af...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-70634

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...

GHSA-6P8F-P8J2-RQMV Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider. When two accepted HTTPRoutes target the same backend Service:port but configure different backendRef filters, Traefik may resolve both routes to the same child service and apply only one route's filter...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

GHSA-3CCP-42PG-HGV6 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

EUVD-2026-54288

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324

Traefik , an open-source HTTP reverse proxy and load balancer, is vulnerable to cross-user response poisoning in its default proxy when forwarding HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream via a shared net/http.Transport . If the upstream returns a keep-alive non-2xx response with...

Malicious code in beautiful-ui-monitoring (npm)

Source: amazon-inspector ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101 [email protected] advertises itself as a UI package description 'creates a beautiful ui design', keywords c/gcc/native but ships no UI code. Its postinstall script invokes gcc -shared -fPIC -o...

Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

Malicious code in beautiful-ui-monitoring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101 [email protected] advertises itself as a UI package description 'creates a beautiful ui design', keywords c/gcc/native but ships no UI...

CVE-2026-64566

A flaw was found in the Linux kernel's iptfs module, which handles network packet processing. When copying shared packet fragments, a critical flag indicating shared memory is not correctly propagated. This can lead to memory corruption within the kernel, potentially causing the system to crash a...