Medium: opensc

Issue Overview: A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The...

MAL-2026-7422 Malicious code in smtp-test-server-node (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7242 Malicious code in chai-chain-test (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7240 Malicious code in chai-as-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in southwark-test-f8e1778549558 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8848 Malicious code in southwark-test-f8e1778549558 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8836 Malicious code in southnews-test-35329 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in southnews-test-35329 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in civic-test-scrape-out (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7601 Malicious code in civic-test-scrape-out (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in civic-test-scrape (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7600 Malicious code in civic-test-scrape (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1168 Apache Superset has improper default REST API permission for Gamma users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introducedchanges which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed...

PYSEC-2026-837 Cross-site Scripting in kiwitcms

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack clickjacking and an HTML injection which disables the use of the history page...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

python3.14-pip security update

25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...

GHSA-473P-56XX-VG67 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

MAL-2026-6893 Malicious code in test-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e81aaf3ca98b6be66b1dd1e6c1c2de4d9487b31d82e74d6c8283b9d9d5a8ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6808 Malicious code in chain-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77e7f01c553ac23e33093f616c3643869064c384e748db9a383cdcf854a07976 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...