Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

CVE-2026-71214

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

Path traversal vulnerability in file parameters

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names. This allows attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system, restricted only by file...

CVE-2026-47682

CVAT contains a path-containment validation flaw in versions 1.6.0–2.64.0. An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server filesystem. The issue enables arbitrary path writes at multip...

CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...

CVE-2026-47763

CVE-2026-47763 affects the Python package manager pdm . In versions prior to 2.27.0, pdm writes several project-local state/config files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets, creating an arbitr...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-18806 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

Important: unbound

Issue Overview: In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to...

UBUNTU-CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-39931

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

EUVD-2026-52342

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

EUVD-2026-52005

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...