Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

OpenSSL 3.6.0 < 3.6.4 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.4 advisory. - Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and n...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

Ghost: Blind Password Hash Disclosure in Ghost Admin API

Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...

CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-70490

Open WebUI (self-hosted AI platform) versions 0.8.8–0.11.0 contain a flaw where the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticates its own first-message JWT and omits the verified-user role gate enforced on HTTP terminal routes. As a result, accounts with pendin...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-24084

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...

CVE-2026-24084

Technical details about CVE-2026-24084 are not publicly available in the provided documents. Monitor for updates from the listed sources; current entries only state a weak configuration related to UE security capability replay verification.

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release

JBoss EAP XP 6.0.5.1 release on the EAP 8.1 base. See references for release notes. A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

CVE-2026-54787

A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and...

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...

CVE-2026-11835

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

CVE-2026-11836 Production Debug-Unlock Token Verification Missing Device Binding

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware validatedebugunlocktoken in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued fo...

CVE-2026-11836

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware validatedebugunlocktoken in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued fo...

Medium: amazon-cloudwatch-agent

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Important: dotnet8.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-2010)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2010 advisory. Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits o...