The mfahelper npm package version 1.0.0 includes a malicious dependency that fetches code from an unrelated GitHub repository's main branch without version pinning or integrity verification. This allows arbitrary code execution during installation and runtime, leading to full system compromise. Removal of the package does not guarantee elimination of the malicious payload. Immediate secret and key rotation is recommended.
urllib3 versions 2.6.2 through 2.7.0 have a vulnerability in their streaming API when handling HTTP responses with both chunked transfer encoding and Deflate content encoding. The decompression process can enter an infinite loop due to trailing bytes after the end of the Deflate stream, causing excessive CPU usage and preventing request completion. This affects applications streaming compressed responses with automatic content decoding enabled. The issue is fixed in urllib3 version 2.8.0.
Axios versions from 1.13.0 up to 1.20.0 have a vulnerability where HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policies. This inconsistency can lead to incorrect proxy usage or DNS resolution behavior during HTTP/2 requests. The issue affects multiple specific versions of node-axios as identified. Red Hat has issued advisories addressing related security issues in their hardened images, but no explicit patch for this Axios vulnerability is detailed in the advisory.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the loki3.6 packages to address multiple vulnerabilities including CVE-2026-21729. The advisory classifies these issues as high severity but does not provide detailed technical information. Updated RPM packages version 3.6.17-0.3.hum1 are available for aarch64 and x86_64 architectures. The update addresses several CVEs including CVE-2026-93450, CVE-2026-63209, CVE-2026-21729, CVE-2026-56851, and CVE-2024-24786. No explicit fixed version is stated beyond the updated package version. The vendor advisory provides official updates and instructions for applying the update.
CVE-2026-15442 is a heap-use-after-free vulnerability affecting all builds using (D)TLS, including default builds. It arises during the TLS shutdown process when certain conditional states occur. Specifically, if an application performs a partial wolfSSL_read() due to a small user buffer, then calls wolfSSL_shutdown for a bidirectional close, and attempts another wolfSSL_read() while the peer continues sending data, a heap-use-after-free condition may occur. This vulnerability has a CVSS score of 5.3, indicating a low severity impact primarily affecting availability.
CVE-2026-93302 is a vulnerability in wolfSSL where the MatchTrustedPeer function ignores the public key during certificate verification. This allows forged CA clones to pass verification, potentially enabling malicious (D)TLS servers or clients to bypass authentication. The issue affects builds enabling the WOLFSSL_TRUST_PEER_CERT macro and using certain APIs to load CA certificates, especially when OPENSSL_COMPATIBLE_DEFAULTS is defined. The vulnerability impacts mutual authentication scenarios.
WolfSSL versions 5.8.4 through 5.9.2 with certain build configurations have a vulnerability where a failed X509_verify_cert call can permanently add an unverified attacker CA to the shared CertManager. This flaw bypasses certificate validation for all consumers relying on the shared CertManager, including native TLS, OCSP, CRL, and direct certificate manager verification. The issue arises only when specific macros (OPENSSL_EXTRA, NO_CERTS, WOLFCRYPT_ONLY) are set in a particular way or when built with --enable-opensslextra, and the application explicitly calls X509_verify_cert.
CVE-2026-89134 is a vulnerability in wolfSSL version 5.9.2 and certain other versions where a certificate lacking a dNSName Subject Alternative Name (SAN) but containing other SAN types can bypass the name-constraint check on the Subject Common Name (CN). This occurs due to fallback logic that incorrectly permits an out-of-scope CN when specific SAN types are present, leading to a name-constraint check bypass. The vulnerability has a CVSS score of 9.1, indicating high severity with impact on integrity and availability. Multiple wolfSSL versions, including some Debian/Ubuntu package versions, are affected. No patch or remediation information is provided in the source data.
A vulnerability in wolfSSL's (D)TLS 1.2 client allows it to accept a ChangeCipherSpec message before sending its ClientKeyExchange. This causes the client to install read keys derived from a known deterministic key, enabling an attacker in a man-in-the-middle position to complete the handshake and send data accepted as authentic. The client's outgoing traffic remains secure, and the genuine server never completes the handshake. The vulnerability has a CVSS score of 3.7, indicating medium severity.
wolfSSL versions 5.9.2 and earlier contain a vulnerability in the X.509 certificate validation logic. The flaw involves improper enforcement of NameConstraints extensions when an unconstrained CA tier exists between a name-constrained intermediate CA and the leaf certificate. This results in acceptance of certificates for unauthorized hostnames due to a chain-walking state-machine bug that resets validation state incorrectly. The issue affects the default build configuration using certificates with name constraints. The vulnerability has a medium severity with a CVSS v3.1 score of 5.3.
CVE-2026-94418 is a vulnerability in wolfSSL when built with the WOLFSSL_SMALL_CERT_VERIFY option enabled. The certificate signature check is performed separately from parsing, which can hide signature verification errors if parsing fails. This allows an attacker to bypass signature checks using a crafted certificate with manipulated validity dates and signatures, but only if the application uses a verify callback that overrides date errors. The issue affects TLS 1.2, TLS 1.3, and DTLS protocols. Exploitation requires specific build options and application behavior.
OpenEXR version 3.4.14 addresses a vulnerability involving a NULL pointer dereference in the C++ attribute parsing path. This occurs when processing a specially crafted EXR file containing an unknown-type attribute with a dataSize set to zero. The issue can cause a denial of service due to application crash. The vulnerability has a CVSS score of 5.5, indicating medium severity.
The npm package 'turbo-ws' version 1.0.0 includes a malicious dependency fetched directly from an unrelated GitHub repository without integrity checks. This dependency executes code during installation, potentially compromising any system that installs the package. The package falsely advertises having zero dependencies, misleading users. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package does not guarantee full remediation due to possible persistent malicious control.
A critical server-side request forgery (SSRF) vulnerability exists in the notebook viewer of GitHub Enterprise Server versions 3.17 through 3.22. The vulnerability allows an attacker to bypass port validation on user-supplied URLs, enabling requests to internal services on different ports. Although response bodies are not returned, timing differences can be exploited to extract instance secrets character by character. These secrets can then be used to achieve remote code execution on the appliance. Exploitation requires network access and is unauthenticated if private mode is disabled; otherwise, any authenticated user can exploit it when private mode is enabled. The issue was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
A stored cross-site scripting (XSS) vulnerability in GitHub Enterprise Server allowed authenticated attackers to inject arbitrary HTML attributes into rendered Markdown. This was due to the Markdown rendering pipeline rewriting quote characters in already-sanitized HTML without re-sanitizing the output. Exploitation could bypass Content Security Policy, enabling control of the page DOM when viewed by other users. Attackers could read visible content, extract CSRF tokens, perform actions as the victim, and exfiltrate data. The malicious payload could also spread to repositories and organizations where the victim had write access. The issue affected multiple supported versions and has been fixed in specific patch releases.
An authorization bypass vulnerability in GitHub Enterprise Server allowed any authenticated user to read raw diffs or patches of pull requests in private repositories without proper authorization. The issue stemmed from access tokens being scoped to repository name and pull request number rather than a globally unique repository identifier. This enabled an attacker who created a repository and pull request with matching names and numbers to access private pull request contents. The vulnerability affected all versions prior to 3.22 and was fixed in versions 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6. Exploitation required knowledge of the target repository name and a valid pull request number. The CVSS score is 6.5 (medium severity).
The npm package @woodpecker-web-shared/components contains malicious code that executes during installation. Its postinstall script collects host system identifiers and sends them to a hardcoded third-party webhook, indicating a reconnaissance beacon consistent with dependency confusion or typosquatting attacks. Installation of this package may lead to full system compromise, and all secrets and keys on affected systems should be rotated immediately. Removal of the package does not guarantee elimination of all malicious components.
The npm package bnppf-flag-icons version 99.99.99 contains malicious code that executes automatically during installation. It collects the host's hostname and OS username and sends this information to an attacker-controlled endpoint. This behavior indicates a dependency confusion attack, as the version number is unusually high and the package name suggests a benign flag-icons library. Installing this package compromises the host, potentially exposing all stored secrets and keys.
A vulnerability in pypdf2 prior to version 6.16.1 allows an attacker to craft a PDF that causes the _get_outline function to consume excessive runtime and memory when processing outlines with many entries or deeply nested reused paths. This can lead to performance degradation or denial of service. The issue has been fixed in pypdf version 6.16.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf2 prior to version 6.16.1 allows an attacker to craft a malicious PDF that causes excessive runtime and memory consumption during text extraction from pages with many XForm objects. This issue has been fixed in pypdf version 6.16.1.