MAL-2026-16109 Malicious code in @auction-fe/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

DEBIAN-CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

EUVD-2026-75108

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials

Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...

firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: UI Events & Focus Handling component...

CVE-2026-21110

Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code...

CVE-2026-21111

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...

CVE-2026-21111

CVE-2026-21111 is an out-of-bounds write vulnerability in the libsthmbc.so library affecting Samsung One UI devices prior to One UI 8.5 . A local attacker with low privileges can write to out-of-bounds memory, potentially compromising the confidentiality of the vulnerable system (CVSS 4.0 score 6...

CVE-2026-21111

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...

CVE-2026-21111

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...

EUVD-2026-74652

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...

CVE-2026-21110

Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code...

EUVD-2026-74651

Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code...

CVE-2026-21110

CVE-2026-21110 is an out-of-bounds write vulnerability in libsavscmn.so affecting Samsung devices running One UI prior to 8.5 . A local attacker with low privileges can exploit this flaw to achieve arbitrary code execution on the vulnerable system. The CVSS 4.0 base score is 6.9 (MEDIUM) , reflec...