112696 matches found
MAL-2026-2701 Malicious code in sanitize-url (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f98260cc1b910a8921671795398ad7f986f02b0b7bc8efef18a4df09b87d51 The package sanitize-url was found to contain malicious code. Source: ossf-package-analysis...
CVE-2026-6410
creationtimestamp| type| source ---|---|--- 2026-04-16 13:38:03+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmjsivtzk2n...
CVE-2026-39313
creationtimestamp| type| source ---|---|--- 2026-04-16 11:59:54+00:00| published-proof-of-concept| https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3 2026-04-16 23:18:23+00:00| published-proof-of-concept| Telegram/x6U1CUbtpfWdw00zGhzow4OOkK7AiEHUVbiM6o3SMYH6zs0...
CVE-2026-6366
creationtimestamp| type| source ---|---|--- 2026-04-16 11:30:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmcoi7iox2s 2026-05-20 02:36:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmauo5ex4q2p...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
CVE-2024-2374
creationtimestamp| type| source ---|---|--- 2026-04-16 10:08:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjm644xfd72t...
Security update for python3
This update for python3 fixes the following issues: CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined bsc1259611. CVE-2026-3479: improper resource argument validation can allow path traversal bsc1259989. CVE-2026-3644: incomplete control charact...
CLSA-2026-1776330599 python3.9: Fix of 11 CVEs
CVE-2025-8291: fix zipfile ZIP64 EOCD Locator offset validation - CVE-2025-6069: fix quadratic complexity in HTMLParser - CVE-2025-4516: fix use-after-free in unicode-escape decoder with error handler - CVE-2026-2297: ensure SourcelessFileLoader uses io.opencode - CVE-2026-3479: reject invalid...
SUSE-SU-2026:21200-1 Security update for go1.25
This update for go1.25 fixes the following issues: Update to go1.25.8 bsc1244485: - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta content attribute actio...
CVE-2026-22619
creationtimestamp| type| source ---|---|--- 2026-04-16 07:16:05+00:00| seen| Telegram/CPpzSH5KUbLaIS5NKRf7RUb00cNUuI-gWISSrbtluJWLjQ 2026-04-16 13:24:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmj2iqflw26...
CVE-2026-40118
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to a dummy URL, the product may unintentionally communicate with the dummy domain, causing...
Malicious code in pretty-logger-js (npm)
pretty-logger-js is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e46da449e6d21efcef5e9975a2f8e90c31369882800ed4c560ae47ade99b53 The packa...
MAL-2026-2913 Malicious code in vite-plugin-compress-plus (npm)
vite-plugin-compress-plus is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65e37bfe23d9bb451691cffd0333e0900835c8982785dde1908973adf2beaa7a...
GHSA-6HW5-45GM-FJ88 @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Summary @fastify/express v4.0.4 fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via two vectors: 1. Duplicate slashes //admin/dashboard when...
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Summary @fastify/express v4.0.4 fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via two vectors: 1. Duplicate slashes //admin/dashboard when...
EUVD-2026-22881
@fastify/express has a middleware authentication bypass via URL normalization gaps duplicate slashes and semicolons...
CVE-2026-40316
creationtimestamp| type| source ---|---|--- 2026-04-16 00:58:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjl7dv32lv2x 2026-04-16 14:05:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmlcxb6k72h 2026-04-17 17:31:16+00:00| seen|...
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests t...
EUVD-2026-23121
ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests t...