A vulnerability in Exim versions before 4.99.2 exists when UTF-8 operators are enabled. This flaw causes an out-of-bounds read if large malformed UTF-8 trailing characters are present in email headers. The issue may lead to information disclosure through error messages generated during the processing of unrelated emails.
CVE-2026-40685 is a vulnerability in Exim versions before 4.99.2 where enabling JSON lookup can lead to an out-of-bounds heap write. This occurs when a JSON operator processes malformed JSON in an untrusted header due to incorrect implementation of escaping. The flaw can cause denial of service but does not impact confidentiality or integrity.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (dfc804efe09ce4a24c8ef96d8f13b88ff8f463aaf89b7c318f345955561ec8c7)
## Source: ossf-package-analysis (8af13a06fb931a42d83e13b19fd998ff62e59ef3d56302bfe9d257e07e2bad46)
The OpenSSF Package Analysis project identified 'supertag' @ 99.1.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/supertag/MAL-2026-3129.json))
## Source: ossf-package-analysis (8af13a06fb931a42d83e13b19fd998ff62e59ef3d56302bfe9d257e07e2bad46)
The OpenSSF Package Analysis project identified 'supertag' @ 99.1.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (8989a6e7b570a831dde23514a11fe5d8b44919c470e8532ec6103864146d0e8d)
## Source: ossf-package-analysis (8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0)
The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/lsh/MAL-2026-3126.json))
## Source: ossf-package-analysis (8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0)
The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (c258f64dff4f22e1d4cd9112448d20ec1fb469290350bfd48af066fc7650d00d)
## Source: ossf-package-analysis (7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8)
The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/amzn_codewhisperer_streaming_client/MAL-2026-3103.json))
## Source: ossf-package-analysis (7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8)
The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (be4df7249c3b3dfbde57c66a5c6118f0ab7be91f8fa45e7eeb1d0eb63d2d0a34)
## Source: ossf-package-analysis (b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91)
The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/amzn_consolas_client/MAL-2026-3101.json))
## Source: ossf-package-analysis (b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91)
The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (0dd56777fc9c2f0f311af228a914590aef7129d64e7a38aa3e861ff22e37b40c)
## Source: ossf-package-analysis (2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c)
The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/semantic_search_client/MAL-2026-3102.json))
## Source: ossf-package-analysis (2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c)
The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
The npm package '@b2b_blocker/show_activation_error' version 99.0.3 has been identified as containing malicious code. Installation or execution of this package can lead to full compromise of the affected computer. It is recommended to remove the package and immediately rotate all secrets and keys from a separate, uncompromised system. However, removal of the package may not fully eliminate all malicious software introduced by it.
The npm package '@apple-pay-trust/merchant-session' versions 99.0.1 and 99.0.3 contain malicious code that executes commands associated with malicious behavior. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised machine due to the risk of persistent malicious control.
The npm package '@apple-pay-trust/start' versions 99.0.1 and 99.0.3 contain malicious code that executes commands associated with malicious behavior. Installing or running this package can lead to full compromise of the affected computer. Immediate removal of the package is recommended, but full remediation requires rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by attackers.
The npm package '@apple-pay-trust/validate-merchant' versions 99.0.1 and 99.0.3 contain malicious code that executes commands associated with malicious behavior. Installation or execution of this package can lead to full compromise of the affected computer, risking exposure of all stored secrets and keys.
The npm package '@sbt_gitverse/analytics-client' versions 99.0.3, 99.0.4, 99.0.5, and 99.0.7 contain malicious code that executes commands associated with harmful behavior. Installation or use of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced.
The npm package '@tochka-ui/foundation' versions 99.0.1, 99.0.3, 99.0.4, 99.0.5, and 99.0.7 contain malicious code. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Removal of the package alone may not fully eradicate the malicious presence.
The npm package '@alfa.life.mapp/app.web' versions 99.0.10, 99.0.11, 99.0.13, 99.0.15, 99.0.16, and 99.0.18 contains malicious code that executes commands associated with malicious behavior. Any system with this package installed or running should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software resulting from its installation.
The npm package '@m0ntana/app.web' versions 99.0.2, 99.0.3, 99.0.5, and 99.0.6 contain malicious code that executes commands associated with malicious behavior. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page.
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.