rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open...

MAL-2026-5911 Malicious code in utils-common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...

CVE-2025-71261

creationtimestamp| type| source ---|---|--- 2026-06-16 17:23:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogctq4vek2m 2026-06-16 19:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogibualxh25...

MAL-2026-5900 Malicious code in chai-as-decrypted (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ed93b06c95c42e3183b89e5fb1d9dea3f711bb20d766861c8d16b8d17f17cc9 Package name chai-as-decrypted mimics the popular chai-as-promised, and the README impersonates pino uses pino's npm badges and links to...

GHSA-M557-WRGG-6RP4

creationtimestamp| type| source ---|---|--- 2026-06-16 15:41:15+00:00| seen| https://gist.github.com/alon710/2ea9580acec8d03d5972005197773fa7...

MAL-2026-5889 Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addAttribute function, which interpolates unescaped object keys as HTML attribute names when spreadi...

rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open...

CVE-2026-12326

creationtimestamp| type| source ---|---|--- 2026-06-16 14:29:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofz3ymu6a2h 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...

MAL-2026-5885 Malicious code in wordpad-text-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...

firefox: thunderbird: Other issue in the WebRTC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the WebRTC component...

firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine: JIT component...

firefox: thunderbird: Other issue in the WebRTC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the WebRTC component...

CVE-2026-12321 JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

CVE-2026-52715

creationtimestamp| type| source ---|---|--- 2026-06-16 11:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofnhilfdv24 2026-06-16 13:47:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofws5zfah22 2026-08-14 20:00:04+00:00| published-proof-of-concept|...

CVE-2026-39581 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability

Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...

CVE-2026-39581

CVE-2026-39581 documents a SQL Injection in the WordPress plugin WP Sessions Time Monitoring Full Automatic for versions

Malicious code in datacamp-light (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 234a0d37873455b7db32068745d93ed29aafa596877b39949280b4ec0621ad6b datacamp-light 99.0.0 impersonates DataCamp's internal package name='datacamp-light', author='DataCamp',...

CVE-2026-42014

creationtimestamp| type| source ---|---|--- 2026-06-16 04:07:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moewdvftpp2p 2026-06-29 11:39:00+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpgfnrmckv2h 2026-06-29 11:39:01+00:00| seen|...

EUVD-2026-37010

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable...