MAL-2026-6457 Malicious code in subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04245cd013e6aa9edb766cf14249c9dd6abd19d6beb9671c22a1a8bbbff3d511 The package's main entry index.js is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfuscation that hides every liter...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-12635

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...

CVE-2026-10712

GitLab CVE-2026-10712 affects GitLab CE/EE with versions 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. The issue is described as improper path validation that could, under certain conditions, allow an unauthenticated user to execute arbitrary JavaScript in a user’s browser ses...

EUVD-2026-39168

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...

EUVD-2026-39109

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within ToggleState.php...

The vulnerability of the JWT/OIDC authentication method of the OpenBao encryption and secret management system allows attackers to perform XSS attacks.

The vulnerability of the JWT/OIDC authentication method of the OpenBao encryption system is related to the lack of mechanisms for encoding or shielding the output data. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire beni...

PT-2026-52377

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is...

Google Chrome FileSystem memory error reference vulnerability

Google Chrome is a web browser developed by Google. Google Chrome has a memory error reference vulnerability. This vulnerability stems from a memory error reference within the FileSystem component. An attacker can exploit this vulnerability to trigger heap corruption through carefully crafted HTM...

PT-2026-52656

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.0 Lemur version 1.9.0 Description The JWT verifier in the lemur/lemur/auth/service.py component trusts the alg header field from unverified tokens and passes it directly into the pyjwt.decode function via the...

PT-2026-52469

Name of the Vulnerable Software and Affected Versions K2 affected versions not specified Description The frontend article-attachment upload path allows the upload of files with the .php extension. When used with Apache's standard mod php, which matches the .php$ pattern, these files are executed...

Oracle Siebel Server <= 26.5 (June 2026 CSPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26....

[SECURITY] [DLA 4647-1] yelp security update

Debian LTS Advisory DLA-4647-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert June 25, 2026 https://wiki.debian.org/LTS Package : yelp Version : 3.38.3-1+deb11u2 CVE ID : not assigned Debian Bug : 1136299 A vulnerability was discovered in yelp, the GNOME help...

Malicious code in leo-auth (npm)

The leo-auth npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6419 Malicious code in leo-cache (npm)

The leo-cache npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

net.aequologica.neo:dagr-vebchar (0.5.2-alpha), net.aequologica.neo:dagr-web (0.5.2-alpha) +108 more potentially affected by CVE-2026-11998 via org.webjars.npm:angular (>=1.2.32, <=1.8.3)

org.webjars.npm:angular MAVEN version =1.2.32, =0.5.2, =0.5.2, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =0.4.0, =1.1.3 and more Source cves: CVE-2026-11998 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17458841...

CVE-2026-9772

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. T...

CVE-2026-9773

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within ToggleState.php...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the authorization process for Git smart HTTP requests. An attacker can gain unauthorized write access to repositories configured as read-only by manipulating the service query string to bypass intended access...