Malicious code in @servicetitan/standalone-ui (npm)

npm/@servicetitan/standalone-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

EUVD-2026-52735

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

CLSA-2026-1784682764 TuxCare security update for npm-user-validate (2 CVEs)

TuxCare rebuilt npm-user-validate to address 2 CVEs. Fixed in 0.1.5-tuxcare.1...

CLSA-2026-1784596325 TuxCare security update for ua-parser-js (2 CVEs)

TuxCare rebuilt ua-parser-js to address 2 CVEs. Fixed in 0.7.22-tuxcare.1...

netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs

A flaw was found in Netty's DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator PRNG for DNS transaction IDs and a static User Datagram Protocol UDP source port. This combination significantly reduces the randomness of DNS queries, making...

CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

EUVD-2026-52672

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation. When Line contains itemcallnumber and t...

CVE-2026-70369

Koha vulnerability CVE-2026-70369 affects the reports/acquisitions_stats.pl workflow. The per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE clauses (covering fields like aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.ho...

CVE-2026-66883

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-63248

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

EEF-CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Summary Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc\plug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program fil...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-66883

OIDCC_Plugin: The vulnerability CVE-2026-66883 affects oidcc_plug (Oidcc.Plug.Authorize) where get_req_header(conn, "User-Agent") is matched case-sensitively, causing the user-agent binding to be inert and bypassable across requests. As a result, the binding check can pass unconditionally, even w...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...