pam_usb 输入验证错误漏洞

pamusb is a Linux hardware authentication tool developed by McDope’s individual developer, based on USB devices. Versions of pamusb prior to 0.9.1 contained a input validation vulnerability. This vulnerability stems from the lack of an upper limit on the number of ndevices being counted in...

PT-2026-43513

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute...

CVE-2026-9468

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results in path traversal. The attack may be...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

Mantis Bug Tracker 安全特征问题漏洞

Mantis Bug Tracker MantisBT is an open-source bug tracker developed by Mantis Bug Tracker. Versions of Mantis Bug Tracker prior to 2.28.1 contained a security vulnerability related to the script-src directive, which allowed bypassing content security policies by uploading specially crafted...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, bom, tfsec, snyk-cli, pulumi-language-dotnet, zot, dagger, grafana-alloy, kubevela, zarf, scorecard, pulumi, k9s, syft, grype, kargo, external-secrets-operator, gitea, nuclei, src-fingerprint, melange, crossplane, terragrun...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, bom, tfsec, snyk-cli, pulumi-language-dotnet, zot, dagger, grafana-alloy, kubevela, zarf, scorecard, pulumi, k9s, syft, grype, kargo, external-secrets-operator, gitea, nuclei, src-fingerprint, melange, crossplane, terragrun...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, bom, tfsec, snyk-cli, pulumi-language-dotnet, zot, dagger, grafana-alloy, kubevela, zarf, scorecard, pulumi, k9s, syft, grype, kargo, external-secrets-operator, gitea, nuclei, src-fingerprint, melange, crossplane, terragrun...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, pulumi-language-java, bom, tfsec, snyk-cli, pulumi-language-dotnet, zot, dagger, grafana-alloy, kubevela, zarf, scorecard, pulumi, k9s, syft, grype, kargo, external-secrets-operator, gitea, nuclei, src-fingerprint, melange, crossplane, terragrun...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: zarf-fips, google-osconfig-agent, argocd-image-updater, chainctl, cerbos, goreleaser, bom, trivy, grafana-alloy, amazon-ssm-agent-fips, packer-fips, argo-events, crossplane, dagger, trivy-fips, trufflehog, apko, osv-scanner, nemo, coder-fips, cg, src-fingerprint,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: zarf-fips, google-osconfig-agent, argocd-image-updater, chainctl, cerbos, goreleaser, bom, trivy, grafana-alloy, amazon-ssm-agent-fips, packer-fips, argo-events, crossplane, dagger, trivy-fips, trufflehog, apko, osv-scanner, nemo, coder-fips, cg, src-fingerprint,...

Astra Linux – Vulnerability in Thunderbird, Firefox

A poorly handled security check during the creation of a WebSocket in a WebWorker caused the Content Security Policy’s connect-src header to be ignored. This could lead to connections being made to restricted origins from within WebWorkers. This vulnerability affects Firefox 109, Firefox ESR 102....

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside of state checks. If the state is not idle, resolvepreparesrc should immediately fail, and no changes to the global state should occur. However, it srcaddr by attempting to create...

Astra Linux – Vulnerability in libmodbus

A heap-based buffer overflow flaw was discovered in libmodbus, within the modbusreply function in src/modbus.c...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU virtual crypto device during handling of data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the values of srclen and dstlen in virtiocryptosymophelper, which may lead to a heap buffer overflow if these values differ...

Malicious code in @mc-xp/mc-monolith-js-src-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2006e65ebcb876e87abed337730b23f079632086ac5af42f731dd65e20dbc56f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

Overview @haxtheweb/iframe-loader is an Adds a loading indicator for iframes. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of elements that allow javascript: URIs in the src attribute. An attacker can execute arbitrary JavaScript in the...

CVE-2026-7182

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1...

PT-2026-41297

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1...

CVE-2026-41692

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute key interpolation tokens inside src and href attribute values with the raw string returned by i18next.t. The substitution logic in...