GHSA-RFR2-MQ9M-X2QX vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-67355 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-MJRX-74JH-7XGW vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

Malicious code in @keyv/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bb14bdfcd4aae57a41c9e6e04cd5f612b12e0f45fbcb57510ccb44b095e77 Analysis of @keyv/[email protected] produced no a static rule matches and no traced behavioral findings. The package is a Redis storage adapter for the key...

MAL-2026-12007 Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

PYSEC-2026-3548 AWS CLI: Overly permissive File Permissions

Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-51144: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-51144

A Cross Site Scripting (XSS) vulnerability exists in Soliton Systems MailZen Management Protal versions v.2.62 and v.2.63 . A remote attacker can exploit this flaw to execute arbitrary code by targeting the Role Name , First Name , Last Name , and Username fields. The vulnerability is characteriz...

CVE-2022-21680 vulnerabilities

Vulnerabilities for packages: arangodb...

CVE-2026-18641 Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

MAL-2026-11513 Malicious code in internallib_v568 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755dfc0e12b6602ff21d04446f2c6bdc23499c0bd9645c14b9209dc25fbb0be5 [email protected] is shaped as a dependency-confusion artifact against a private package name. The main module exports a payload containing a...

MAL-2026-11510 Malicious code in beaver-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece The package is advertised as a React UI layout library but on require'beaver-ui-layout' loads bridge.js, which reconstructs hostnames from array-join...

Linux Distros Unpatched Vulnerability : CVE-2026-59638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle fo...

Linux Distros Unpatched Vulnerability : CVE-2026-8763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before...

Linux Distros Unpatched Vulnerability : CVE-2026-12803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross- nonce AEAD forgery. This issue also affects Bouncy Cast...

Linux Distros Unpatched Vulnerability : CVE-2026-12185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java...

Malicious code in tailwindcss-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...