The npm package css-reading-display-polyfill, version 1.0.0, contains malicious code that executes system commands to collect sensitive host information and environment variables, then exfiltrates this data to a hardcoded external webhook. The package masquerades as a CSS polyfill but instead acts as a dependency confusion probe targeting Wix build infrastructure, potentially leaking CI secrets and cloud credentials.
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.
CVE-2026-87675 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. It occurs in the configuration management subsystem during configuration download operations, where user-supplied input is passed unsanitized to an internal utility script. This allows execution of arbitrary OS commands on the affected switch when an administrator initiates the configuration download.
CVE-2026-87674 is a local privilege escalation vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. The flaw arises from insufficient access controls on internal IPC channels in the system logging daemon, allowing unprivileged local users to submit malformed logging configurations. Improper input sanitization during configuration file generation enables injection of arbitrary directives that execute with elevated privileges when the logging service reloads.
CVE-2026-87673 is an OS command injection vulnerability in Brocade Fabric OS maintenance command-line diagnostic utilities. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability arises because the binary does not properly sanitize user input when invoking system commands via a shell interpreter. A privileged user with maintenance account access can exploit this flaw to execute arbitrary OS commands with root privileges.
CVE-2026-87687 is a high-severity vulnerability in Brocade Fabric OS that affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It allows an authenticated user with restricted privileges in one Virtual Fabric to exploit improper input validation by submitting a specially crafted request with an arbitrary fabric identifier. This leads to unauthorized cross-fabric operations and unauthorized viewing of configuration details in other Virtual Fabrics or tenants.
CVE-2026-87685 is an arbitrary file manipulation vulnerability in the WebTools management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated administrative user can exploit this by submitting a crafted status file path parameter, causing arbitrary system files to be moved to a world-readable temporary directory. This can result in persistent denial of service, critical system file destruction, host compromise, or sensitive data leakage.
CVE-2026-87688 is a command injection vulnerability in the Brocade Fabric OS administrative management API's certificate management component. It occurs due to insufficient input sanitization of user-supplied certificate identifiers during certificate deletion operations. An authenticated attacker with certificate deletion privileges can exploit this flaw to execute arbitrary system commands with the management daemon's privileges. This affects Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability has a high severity score of 8.5 CVSS v4.0.
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.
A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.
A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.
A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an internal argument array without enforcing boundary checks on the maximum array capacity. An authenticated user with administrative access can exploit this vulnerability by supplying a crafted diagnostic command string containing an excessive number of tokenized arguments. This leads to a memory overwrite resulting in a denial of service (process crash).
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.
The npm package 'tensorlake' version 0.5.144 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised system is strongly advised.
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application.