CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in the file src/Modules/Items/Repositories/ItemsRepository.php, as identified in a researcher report published on GitHub. The vulnerability type and affected component are confirmed, but no CVSS metrics, exploit status, or remediation guidance are ...

Astra Linux – Vulnerability in libwebp

A flaw was discovered in libwebp in versions prior to 1.0.1. A heap-based buffer overflow is possible in the function WebPDecodeRGBInto due to an invalid check for buffer size. The greatest threat from this vulnerability is related to data confidentiality and integrity, as well as system...

Astra Linux – Vulnerability in libwebp

A heap-based buffer overflow was discovered in libwebp in versions prior to 1.0.1 in the GetLE24 function...

Astra Linux – Vulnerability in libwebp

A flaw was discovered in libwebp in versions prior to 1.0.1. When reading a file, libwebp allocates an excessive amount of memory. The greatest threat posed by this vulnerability is related to service availability...

Astra Linux – Vulnerability in libwebp

A heap-based buffer overflow was discovered in libwebp in versions prior to 1.0.1 in the ApplyFilter function...

EUVD-2026-60935

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

EUVD-2026-56785

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

MAL-2026-12067 Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

CLSA-2026-1785117455 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.1-tuxcare.2...

CLSA-2026-1784683082 TuxCare security update for cookie-signature (4 CVEs)

TuxCare rebuilt cookie-signature to address 4 CVEs. Fixed in 1.0.1-tuxcare.1...

CLSA-2026-1780879895 TuxCare security update for json5 (4 CVEs)

TuxCare rebuilt json5 to address 4 CVEs. Fixed in 1.0.1-tuxcare.1...

CLSA-2026-1772669620 TuxCare security update for chownr (4 CVEs)

TuxCare rebuilt chownr to address 4 CVEs. Fixed in 1.0.1-tuxcare.1...

CLEANSTART-2026-ZW66721 Security fixes in kube-vip 1.0.1-r0

Package kube-vip version 1.0.1-r0 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-JK72003 Security fixes in clamav 1.0.1-r0

Package clamav version 1.0.1-r0 fixes 2 vulnerabilities: CVE-2023-20032, CVE-2023-20052...

EUVD-2026-50110

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...

MAL-2026-11070 Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute filename path which...

MAL-2026-11064 Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...