---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (b78321d5059e11bc71690bbb965780622cd835221d353fecb34eb51ee2e9716e)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A vulnerability in the Amazon Kinesis Producer Library for Java before version 1.0.8 allows sensitive AWS credentials to be exposed in log files when the logger is set to DEBUG level. Additionally, these credentials may be passed as command-line arguments to native child processes, where local users can read them. This issue is fixed in version 1.0.8.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (c80a97b5efe6344f25a34ed662f62f49fa91b032c477766b4fbad94f3ff15c5f)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (b1d6fe89dfa7e3ac7b6bb69388ac3d1584a4756a53f2b58f490739f409663324)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-84243 is a path traversal vulnerability in the gettext functions of the GNU C Library (glibc) version 2.0 and later. It allows an attacker who can control the LANGUAGE environment variable to cause the program to load message catalog files from arbitrary filesystem locations. Crafted message catalogs can crash the program or cause undefined behavior in printf functions, potentially leading to arbitrary code execution with the program's privileges. Exploitation requires the attacker to also select a non-C locale and place a malicious file in a readable location. This vulnerability bypasses previous fixes that did not cover the LANGUAGE variable.
CVE-2026-119086 is a type confusion vulnerability in FreeRTOS-Kernel versions 7.4.0 through 11.3.2 on MPU-enabled ports with queue sets enabled. It allows a local unprivileged task to write data beyond a pointer-sized object on the privileged kernel stack, potentially affecting privileged memory across the MPU isolation boundary. This issue is fixed in FreeRTOS-Kernel version 11.3.3. Builds without queue sets enabled are not affected.
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates
FlowiseAI Flowise versions up to 3.1.4 contain a sandbox escape vulnerability that allows authenticated users to execute arbitrary OS commands. This occurs when the configuration ALLOW_BUILTIN_DEP is set to true, enabling abuse of allowlisted langchain and mammoth modules. Attackers can submit JavaScript code to the /api/v1/node-custom-function endpoint, which writes a file into the mammoth package via LocalFileStore and requires it, thereby escaping the vm2 sandbox as the Flowise process user.
Mythic versions 3.2.16 through 3.4.0.61 contain a stored cross-site scripting (XSS) vulnerability. Attackers who control target endpoint files can embed malicious HTML in files named with a .pdf extension. When an operator previews such a file in the Mythic UI, the malicious HTML executes with the same origin, allowing theft of localStorage JWT tokens. These tokens grant full GraphQL and REST API access, potentially compromising the system.
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. Exploitation occurs when a recipient opens a folder containing a crafted email, potentially leading to mailbox content theft or redirection. The vulnerability is fixed in versions 10.6.39 and 10.7.1.
sniproxy versions up to 0.7.0 have a NULL pointer dereference vulnerability in the resolv_cancel() function. This flaw can be triggered remotely by unauthenticated attackers sending overlong hostnames (254 or 255 characters) in TLS SNI or HTTP Host headers that match a wildcard backend, causing the proxy daemon to crash.