2102211 matches found
MAL-2026-16486 Malicious code in @baanx/domain (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a18b786cad636e5b1ac77f23ac054b08d161ad5981c0ed731e14b116167d4859 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16485 Malicious code in @baanx/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d272d47a4b0d81c2aca10da98d90d30033d41d50bd3aeb3b925fb99cbe40b3f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MGASA-2026-0443 Updated pipewire packages fix security vulnerabilities
RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 Multiple unbounded alloca calls in the PulseAudio protocol server. CVE-2026-14330...
MGASA-2026-0442 Updated libwebsockets packages fix a security vulnerability
warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...
ECHO-EE84-011B-7127
Bulletin has no description...
MAL-2026-16483 Malicious code in @rixxcodex/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b5247e2f10d09b51e8d59c4b36cb2cbe62909af4be588fdb07dabf0afabcf2 This package is a fork of the Baileys WhatsApp library that adds three undocumented channels which use the installer's authenticated WhatsApp session...
MAL-2026-16484 Malicious code in pino-testkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7 [email protected] impersonates the widely-used pino logger: package.json declares the name pino-testkit with pino's description, lists Matteo Colli...
GHSA-9643-4QGH-G8MX elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...
GHSA-WMW4-MW6X-6VFM ReactPress has SQL injection via dynamic column names in TypeORM query builders
Summary ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string...
GHSA-8PCW-H6W9-H46G plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.contenttypes. On Plone 6.2, upgrade to plone.app.contenttypes...
MINI-8JFX-R2RH-2GXX
Bulletin has no description...
MINI-3CC8-33JX-9M8R
Bulletin has no description...
MINI-4FRV-3JXF-R547
Bulletin has no description...
MINI-6GR6-V49F-79X3
Bulletin has no description...
MINI-VP6W-FM3G-FV4C
Bulletin has no description...
MINI-8PGG-X63J-5HWR
Bulletin has no description...
MINI-JHFF-W6XV-X6M2
Bulletin has no description...
MINI-MGWR-Q4MQ-2HV3
Bulletin has no description...
MINI-3GX3-JH3Q-7JHQ
Bulletin has no description...
MINI-W6JG-8HVF-JCHF
Bulletin has no description...
MINI-JXX2-8F9H-P8XM
Bulletin has no description...
MINI-69GH-Q8P6-425V
Bulletin has no description...
GHSA-5426-92W4-WVHV plone.app.dexterity has a Denial of Service due to excessive title or description length
Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...
MINI-WJVM-CFFH-5PF6
Bulletin has no description...
MINI-XWV6-5FCV-JG2P
Bulletin has no description...
MINI-JP4W-5R89-X7VW
Bulletin has no description...
MINI-MJP7-336H-V8XC
Bulletin has no description...
MINI-CHH2-85C8-M4V8
Bulletin has no description...
MINI-R8RW-G7G4-C2V5
Bulletin has no description...
MINI-6483-X4PQ-3FFR
Bulletin has no description...
GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...
GHSA-9WH6-9HQ7-9688 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Location: core/kapp/validators/validators.go:201 Register, genesis/checking/nodesSetupChecker.go:73. core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 Create.... Description Klever uses a BDN Boneh-Drijvers-Neven BLS multi-signature over BLS12-381 to...
GHSA-7C7C-373R-GFJJ Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Component: Elasticsearch indexer indexer/ Primary location: indexer/common.go:2395-2407 serializedDataForUpdateAccounts Entry point: SetAccountName native transaction contract type 12 — core/process/transaction/txProcess.go:688 --- Description When the node indexes account updates to Elasticsearc...
GHSA-26R5-4MM2-PX5C Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
Location: core/kapp/market/market.go — Buy approx. L281–436\ Severity: High The native marketplace enforces an IsClaimed guard in Claim market.go:752, CancelOrder market.go:1125, and orderEscrowAmount market.go:251, but not in Buy. Marketplace escrow is virtual: the market KApp account never...
GHSA-9RG8-2WVR-FGJH Formie: Missing authorization on sent notification resend modal exposes submission PII
Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...
GHSA-W4CM-GVHJ-CGW6 Jawn: Quadratic parsing effort in AsyncParser
AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...
GHSA-CC4V-RVGP-2PF3 Jawn: Uncontrolled nesting depth in JSON parser
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. Impact A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger java.lang.OutOfMemoryError. This is treated by Scala as a fatal error and not typically handl...
CGA-V5H3-P32M-XRRG
Bulletin has no description...
CGA-JWJ7-R88G-WPRX
Bulletin has no description...
CGA-3XQP-PMCX-6FV6
Bulletin has no description...
PYSEC-2026-3987 MemoryOS 2.0.34 was published with a credential-stealing binary
An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/stage0.py, which launches a bundled sckit binary that collects credentials...
GHSA-97CV-X867-6XHM Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
Description The VM built-in function KleverUpdateAccountPermission registered always-active, creator.go:381-390 / core/vmconstants.go:234 rewrites an account's entire permission set. Its authorization check uses vmInput.RecipientAddr attacker-controlled instead of the authenticated...
DEBIAN-CVE-2026-75131
Bulletin has no description...
GHSA-4FWH-WRM6-97XM Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...
GHSA-9V8P-FRVJ-2PCM Klever-Go: /log controls global node logging
An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an...
CGA-567M-RR35-R4QC
Bulletin has no description...
CGA-4JF6-CPW2-97V4
Bulletin has no description...
CGA-R87F-Q7MR-8Q75
Bulletin has no description...