Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

CVE-2026-17544

A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the bccomp function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the...

CVE-2026-71214

CVE-2026-71214 (NASA-AMMOS plandev sequencing-server) : The authorization middleware in sequencing-server derives the caller’s Hasura session role via getHasuraSession(), preferring a client-supplied session_variables object from the request body over JWT claims in the Authorization header, witho...

Multiple vulnerabilities in NetKids iMark

Overview NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities listed below: Uncontrolled search path element CWE-427 - CVE-2026-66344 Unquoted search path or element CWE-428 - CVE-2026-66839 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...

CVE-2026-7726

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

EUVD-2026-53021

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

PT-2026-68262

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...

UBUNTU-CVE-2026-59679

Font Server Client encoding Out-Of-Bounds Read/Write...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

CVE-2025-63822

Technical details beyond the generic description are not provided in the supplied documents. Monitor for updates on affected versions, root cause, impact, and remediation.

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2026-70593

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...