CVE-2026-48984 pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap

pamusb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree memory release helper in calls free without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read fr...

Malicious code in @onum-releases/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d4bde1772d506f812e112fb8d6bfbf6a6f187dd823640f2cf15811f0d0633a On require'@onum-releases/auth', index.js reads os.hostname and issues an HTTP GET to auth..200majoeu01dk02xnjdajro1isojc90y.oastify.com, transmittin...

praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary The issue create and update endpoints in praisonai-platform accept a projectid in the request body and persist it without validating that the project belongs to the URL workspace. A user who is a member of workspace WB and has no access to workspace WA can create issues that reference a...

CVE-2026-54193

creationtimestamp| type| source ---|---|--- 2026-06-18 14:09:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mokywfkbzb2n...

EUVD-2026-37894

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-tim...

CVE-2026-12527

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-tim...

CVE-2026-12527

A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-tim...

TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and execut...

GHSA-2VCC-5V34-9JC8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and execut...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the factorial operator implementation. An attacker can cause excessive CPU consumption or application unresponsiveness by submitting specially crafted expressions with extremely...

CVE-2026-54222

UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to interact with the underlying database. Due to insufficient input sanitization, an attacker can extract sensitive information, such as user credentials, by manipulating SQL queries...

CVE-2026-22283

creationtimestamp| type| source ---|---|--- 2026-06-18 09:03:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116770300607907622...

CVE-2026-10736

creationtimestamp| type| source ---|---|--- 2026-06-18 08:15:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokf5nzsdj2z 2026-06-19 02:33:25+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3momciyt73y2g...

MGASA-2026-0221 Updated libcap packages fix security vulnerabilities

CVE-2026-4878. A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By...

Updated libcap packages fix security vulnerabilities

CVE-2026-4878. A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By...

Security update for rustup

This update for rustup fixes the following issues CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion bsc1257902. rust-shlex: Multiple issues involving quote API RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27 bsc1230032. Patch Instructions: To...

CVE-2026-54224

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219...

sql-injection-detector

SQL Injection Detector !testshttps://github.com/ayondey47...

Malicious code in jwtmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59454613cc025e514269f55b41a9da6a5da1db70e73e583bc79d97727e9528a On require'jwtmode', decode.js immediately invokes getThirdCookie, which performs an HTTP GET to https://jsonkeeper.com/b/AZ9ZF, takes the response...

MAL-2026-6090 Malicious code in data-utils-bcf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52e6ddf4cbc1a035918a5bd136c865ff526f430db21268d75d3c90fa74196fdf The package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that automatically executes run.js on install. run.js...