MAL-2026-14987 Malicious code in 3layerdipstackyhk67g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a14063a63b93a354f17cefd237f38a54346ee86b45ef2d64398faf0bb63d47 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14627 Malicious code in 3layerdipstack4wsms0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c375da30bd4dc753181260b33918aec7b17b0c4bc5ecd3ac06dc3676055d84f0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackuew4bh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f693f3775d167495f7080e39f299df6fb4cc1e282f79718d712fcca91076e82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackvkl1hd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b377c7fe1096a29a14d5b88a8976bffe545ab4fae10c8833cc53fd72c2f9a1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14885 Malicious code in 3layerdipstackq4ek0f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d889748f378b114bb74220ed9ecf1dfbf2548c5126539fe997b409e201c4b23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

DEBIAN-CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

AZL-98409 CVE-2026-82253 affecting package rust for versions less than 1.75.0-30

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82249

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

DEBIAN-CVE-2026-82249

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

UBUNTU-CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

UBUNTU-CVE-2026-82249

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

CVE-2026-82255

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...

CVE-2026-82249 gitoxide before 0.38.2 Credential Helper Protocol Field Injection

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

The vulnerability in the Networking component of Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, allows attackers to gain access to confidential data and compromise data integrity.

The vulnerability in the Networking component of Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromi...

PT-2026-83099

Name of the Vulnerable Software and Affected Versions gix-url versions prior to 0.37.1 gix-transport versions prior to 0.58.1 Description The gix-url crate employs a custom URL parser that fails to treat '?' or '' as terminators for the authority component, violating RFC 3986. This leads to a...

Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

EUVD-2026-63467

WebOb: Open redirect in Location header normalization via leading C0 control / space characters...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-81731

Frappe versions 15.11.0 through 16.32.0 contain a stored XSS in the Workspace Link doctype's description field. The field is declared with ignore_xss_filter: 1 , causing _sanitize_content() to skip HTML filtering. The unfiltered value is later interpolated into a Bootstrap popover via LinksWidget...