MAL-2026-2425 Malicious code in bytefrontier-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a556a5a46fe4be2c1c7662a6481c9086b192375a17d4dcdccfbe52564ed78571 The package bytefrontier-tracker was found to contain malicious code. Source: ghsa-malware...

Malicious code in bytefrontier-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a556a5a46fe4be2c1c7662a6481c9086b192375a17d4dcdccfbe52564ed78571 The package bytefrontier-tracker was found to contain malicious code. Source: ghsa-malware...

Malicious code in partner-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0b992863c06f797a9dddef6a493b0391094c9a2ae31fec47e961dd1afdf562 The package partner-tracker was found to contain malicious code. Source: ghsa-malware cfd28d767cd7e0db43c5c52d0b219663552acd6a5f60a34795736624c5cb612...

MAL-2026-2426 Malicious code in partner-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0b992863c06f797a9dddef6a493b0391094c9a2ae31fec47e961dd1afdf562 The package partner-tracker was found to contain malicious code. Source: ghsa-malware cfd28d767cd7e0db43c5c52d0b219663552acd6a5f60a34795736624c5cb612...

MAL-2026-2427 Malicious code in partner-tracker-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abcff950068cf454cf07ead8614f95dd6291f4204f72ada102c7b4c3d72c0cd1 The package partner-tracker-api was found to contain malicious code. Source: ghsa-malware...

Malicious code in partner-tracker-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abcff950068cf454cf07ead8614f95dd6291f4204f72ada102c7b4c3d72c0cd1 The package partner-tracker-api was found to contain malicious code. Source: ghsa-malware...

sientia-tracker (>=1.0.2, <=1.0.7) potentially affected by CVE-2026-0596 via mlflow (2.10.1)

mlflow PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sientia-tracker =1.0.2, =1.0.7 Source cves: CVE-2026-0596 Source advisory: OSV:GHSA-RVHJ-8CHJ-8V3C...

sientia-tracker (>=1.0.2, <=1.0.7) potentially affected by CVE-2025-15379 via mlflow (2.10.1)

mlflow PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sientia-tracker =1.0.2, =1.0.7 Source cves: CVE-2025-15379 Source advisory: OSV:GHSA-R23Q-823P-VMF7...

sientia-tracker (>=1.0.2, <=1.0.7) potentially affected by CVE-2025-15036 via mlflow (2.10.1)

mlflow PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sientia-tracker =1.0.2, =1.0.7 Source cves: CVE-2025-15036 Source advisory: OSV:GHSA-VHCX-3PQ2-4FVC...

sientia-tracker (>=1.0.2, <=1.0.7) potentially affected by CVE-2025-15381 via mlflow (2.10.1)

mlflow PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sientia-tracker =1.0.2, =1.0.7 Source cves: CVE-2025-15381 Source advisory: OSV:GHSA-G6PG-52VF-843H...

[SECURITY] [DLA 4510-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4510-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 26, 2026 https://wiki.debian.org/LTS -...

CVE-2026-30849

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-33517

Mantis Bug Tracker MantisBT is an open source issue tracker. In version 2.28.0, when deleting a Tag tagdelete.php, improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Versi...

CVE-2026-33548

Mantis Bug Tracker MantisBT is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline myviewpage.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has...

EUVD-2026-14525

MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline...

GHSA-FH48-F69W-7VMP MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation

Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Impact Cross-site scripting XSS. Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46 Workarounds Revert commit...

EUVD-2026-14523

MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation...

[SECURITY] [DSA 6177-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6177-1 [email protected] https://www.debian.org/security/ Andres Salomon March 25, 2026 https://www.debian.org/security/faq -...

CVE-2026-33401

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 CVE-2026-30840 added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI...

CVE-2026-33407

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTPPROXY and HTTPSPROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search...