PT-2026-26242

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

GHSA-8QVF-MR4W-9X2C Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Summary A Path Traversal vulnerability allows any user or attacker supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service via crash loops when reading...

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Summary A Path Traversal vulnerability allows any user or attacker supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service via crash loops when reading...

CVE-2026-32634

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead ...

CVE-2026-32632

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

Malicious code in ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c66ea54316ebd799590186156adab4ff03ad3108487b4c5c48192924efcd60a The package ui-coremal was found to contain malicious code...

MAL-2026-1870 Malicious code in ui-core_mal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c66ea54316ebd799590186156adab4ff03ad3108487b4c5c48192924efcd60a The package ui-coremal was found to contain malicious code...

MAL-2026-1743 Malicious code in haodesk-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d84a56e7e332520633c65a2690e70d5eb4792907c98da8a7d6830a463438c7d2 The package haodesk-ui was found to contain malicious code...

Malicious code in haodesk-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d84a56e7e332520633c65a2690e70d5eb4792907c98da8a7d6830a463438c7d2 The package haodesk-ui was found to contain malicious code...

MAL-2026-1703 Malicious code in dataterminal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5edeeb534b27862802b775a378680a4755cccb09d13481c4525f63821bd81d The package dataterminal-ui was found to contain malicious code...

Malicious code in dataterminal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5edeeb534b27862802b775a378680a4755cccb09d13481c4525f63821bd81d The package dataterminal-ui was found to contain malicious code...

Malicious code in @legacy-ui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc68fa0af265da13a26ccfc943668c887b5aa3f4a73ddc7af9ab2d8498d7a0d The package @legacy-ui/core was found to contain malicious code...

MAL-2026-1628 Malicious code in @legacy-ui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc68fa0af265da13a26ccfc943668c887b5aa3f4a73ddc7af9ab2d8498d7a0d The package @legacy-ui/core was found to contain malicious code...

Malicious code in @cbreone/survey-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa512020ca8dd602c54abcdc6b69379bc5656423a35dabd5200db0e3b8af7fd6 The package @cbreone/survey-ui was found to contain malicious code...

MAL-2026-1592 Malicious code in @cbreone/survey-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa512020ca8dd602c54abcdc6b69379bc5656423a35dabd5200db0e3b8af7fd6 The package @cbreone/survey-ui was found to contain malicious code...

MAL-2026-1591 Malicious code in @cbreone/micro-ui-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d740150668055ded0e2a179405c28d897f9ad333829b48a26892be6e8d6e3f27 The package @cbreone/micro-ui-survey was found to contain malicious code...

Malicious code in @cbreone/micro-ui-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d740150668055ded0e2a179405c28d897f9ad333829b48a26892be6e8d6e3f27 The package @cbreone/micro-ui-survey was found to contain malicious code...

Malicious code in @cbreone/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e204888ba2b9573e474d804f28f51173684bb25f640615a9eaae217c5e1a45 The package @cbreone/core-ui was found to contain malicious code...