43635 matches found
EUVD-2026-51588
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...
CVE-2026-21662 FMS Employee Allows Upload of Unrestricted Files
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...
SUSE CVE-2026-55998
The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...
SUSE CVE-2026-62291
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...
MAL-2026-11431 Malicious code in @0xlr/dep-confusion-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Anthropic on Thursday became the latest artificial intelligence AI company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the...
Malicious code in @peptide-packets/js-unimode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...
GHSA-724G-MXRG-4QVM vulnerabilities
Vulnerabilities for packages: renovate...
GHSA-WC2C-7F6V-VHF3 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-XJFQ-6RHW-XJ37 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-16393 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-727J-G2FH-46CV vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-M5J7-35RX-PHQ8 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-16370 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-G69W-566R-7R56 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-16399 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-16403 vulnerabilities
Vulnerabilities for packages: firefox...