CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

EulerOS 2.0 SP13 : ca-certificates (EulerOS-SA-2026-2960)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

EulerOS 2.0 SP13 : ca-certificates (EulerOS-SA-2026-3010)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

EulerOS 2.0 SP15 : ca-certificates (EulerOS-SA-2026-2877)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

EulerOS 2.0 SP15 : ca-certificates (EulerOS-SA-2026-2918)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

Malicious Package

Overview wallet-monitor-snap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-18927

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-18927 imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

Malicious code in bigops-storio-ngrx-component-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e The package name resembles @ngrx/component-store. The main entry index.js requires./helpers, which on module load assembles attacker-controlled...

MAL-2026-13256 Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

Malicious code in store-locator-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5 [email protected] ships an empty library body index.js exports and a preinstall hook node callback.js that, on npm install, collects the...

MAL-2026-12804 Malicious code in store-locator-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5 [email protected] ships an empty library body index.js exports and a preinstall hook node callback.js that, on npm install, collects the...

Malicious code in luluking3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays...

Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

EUVD-2026-53362

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. Authorizatio...

CVE-2026-55997

CVE-2026-55997 concerns Rancher where long-lived registration tokens used to authenticate nodes/agents into a downstream cluster were stored in plaintext with no expiration. The tokens could be obtained via the Rancher API, etcd, automation, or direct file access on a node and used at any time to...

CVE-2026-16746

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...