Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...

MAL-2026-12214 Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...

MAL-2026-12231 Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12045 Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

CVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110

OpenCode Studio prior to version 2.4.4 is affected by an unauthenticated file-read vulnerability exposed via GET /api/tmp/:tmpFile and GET /api/music/:fileName, permitting reading of arbitrary files from temp and static/music directories and exposing intermediate artifacts (audio/video) and subti...

EUVD-2026-52743

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

SUSE SLES12 Security Update : gzip (SUSE-SU-2026:3241-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3241-1 advisory. This update for gzip fixes the following issue: - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not...

openSUSE 16 Security Update : gzip (openSUSE-SU-2026:21371-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21371-1 advisory. This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2754)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename whe...

SUSE-SU-2026:22753-1 Security update for gzip

This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH bsc1269622...

SUSE-SU-2026:22818-1 Security update for gzip

This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH bsc1269622...

CVE-2026-55629 Whistle: Path traversal

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...

Fedora 44 : roundcubemail (2026-517daa8d64)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-517daa8d64 advisory. Release 1.7.2 - Add HEAD request handler to the static.php - Fix so the oauthpasswordclaim claim is retrieved via token or userinfo request 9631 - F...

Linux Distros Unpatched Vulnerability : CVE-2026-61863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.x before 6.9.13-51 contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting i...

Vulnerabilities in Palo Alto Networks PAN-OS

Palo Alto Networks has identified several vulnerabilities in the PAN-OS software, particularly in PA-Series and VM-Series firewalls, as well as the Panorama management platform. These vulnerabilities affect various components of PAN-OS. - There are several XSS vulnerabilities in the User-ID...