MAL-2026-5297 Malicious code in consumerweb-authflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dfe3a6140cb37159a3f0284f9e5977fc40e3bfe77b7d320e1e13d5cb55e75c1 On npm install, postinstall.js executes automatically and POSTs the installer's hostname, OS username, and platform over HTTPS to a Burp Collaborator...

UBUNTU-CVE-2026-38978

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths...

CVE-2026-49009

Northern.tech Mender Server suffers a Directory Traversal vulnerability (CVE-2026-49009) affecting v4.0.1 and earlier and v4.1.0 and earlier. The issue is resolved in v4.0.2 and v4.1.1. Public sources describe it as an input sanitization/access control problem that enables traversal outside inten...

CVE-2026-49009

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal...

EUVD-2026-25127

IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1...

CVE-2026-35050 text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, thi...

CVE-2026-35050

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, thi...

PT-2026-30687

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, thi...

CVE-2026-34974

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ SvgSanitizer.php can be bypassed using HTML entity encoding in javascript: URLs within SVG attributes. Any user with editfaq permission can upload a malicious SVG that executes...

CVE-2026-34974 phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ SvgSanitizer.php can be bypassed using HTML entity encoding in javascript: URLs within SVG attributes. Any user with editfaq permission can upload a malicious SVG that executes...

CVE-2026-34973

CVE-2026-34973 affects phpMyFAQ prior to 4.1.1. The bug is in the searchCustomPages() function where real_escape_string() (via escape()) sanitizes the search term for LIKE clauses but does not escape SQL LIKE metacharacters % and _. Consequently, an unauthenticated attacker can inject wildcards i...

CVE-2026-34973

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE...

CVE-2026-32629 phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 quoted local part yet contains raw HTML — for example "alert1"@evil.com. PHP's FILTERVALIDATEEMAIL accepts this...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multilingual FAQ system developed by Thorsten Rinne. It is entirely database-driven. Versions of phpMyFAQ prior to 4.1.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from an issue with Filter::removeAttributes, where regular expressions were bypassed,...

CLEANSTART-2026-NV84668 Security fixes for ghsa-84h7-rjj3-6jx4, ghsa-vc5p-v9hr-52mj applied in versions: 4.1.1-r1

Multiple security vulnerabilities affect the spark-sc213-jdk17-py314 package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NA08955 Security fixes for ghsa-84h7-rjj3-6jx4, ghsa-vc5p-v9hr-52mj applied in versions: 4.1.1-r1

Multiple security vulnerabilities affect the spark-sc213-jdk17-py311 package. These issues are resolved in later releases. See references for individual vulnerability details...

OPENSUSE-SU-2026:10318-1 helm-4.1.1-3.1 on GA media

These are all security issues fixed in the helm-4.1.1-3.1 package on the GA media of openSUSE Tumbleweed...

CLEANSTART-2026-OO47906 Security fixes for GHSA-VC5P-V9HR-52MJ applied in versions: 4.1.1-r0

Security vulnerability affects the kafka package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZS11519 Security fixes for GHSA-vc5p-v9hr-52mj applied in versions: 4.1.1-r0

Security vulnerability affects the kafka-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-0872 Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon

Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.This issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2...