Sonatype Nexus Repository 3 versions 3.93.0 through 3.97.x have a vulnerability where an account with only read privileges on a YUM proxy or group repository can obtain the private signing key. This key allows signing of repository metadata, which should require higher privileges. The issue is fixed in version 3.98.0.
Sonatype Nexus Repository 3 Pro versions from 3.86.0 up to but not including 3.98.0 contain a critical authentication vulnerability. The product does not verify the local account status when users authenticate via configured SAML or OAuth2/OpenID Connect identity providers. This allows users whose Nexus accounts have been disabled or locked by an administrator to sign in again using valid identity provider credentials and regain access with their original roles. The vulnerability requires a valid identity provider account and does not affect anonymous users.
Sonatype Nexus Repository 3 versions from 3.0.0 up to but not including 3.98.0 contain a missing authorization vulnerability (CWE-862). This flaw allows a user with only the capability creation permission to create a Rut Auth capability, enabling header-based authentication. Consequently, a remote client can authenticate as any existing user, including administrators, without providing credentials. This vulnerability has a high severity score of 8.6 and is fixed in version 3.98.0.
The npm package @pubngo-stack/help-browser version 12.0.23-alpha.3 contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets and keys from a different, secure computer is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by the compromise.
The npm package @cdmbase/wiki-browser version 12.0.18-alpha.53 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have gained full control of the system.
The npm package @adminide-stack/yantra-help-browser version 12.0.194 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The npm package @adminide-stack/forms-core version 5.1.9-alpha.3 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised machine due to the possibility of persistent malicious software.
The npm package 'cdeops' version 13.5.31 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @adminide-stack/user-activity-browser versions 1.1.3-alpha.114 and 0.0.16-129 contains malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised.
The npm package @adminide-stack/health-api-server version 0.0.18-alpha.465 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package @adminide-stack/client-redux version 0.0.16-18 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @adminide-stack/utils version 0.0.16-130 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
CVE-2026-122192 is a vulnerability in AWS Firecracker versions 0.23.0 through 1.16.1 where improper handling of a failed memory remap can allow a guest user with root privileges to read or modify the Firecracker VMM process memory. This occurs via balloon or virtio-mem discard requests on microVMs restored from snapshots using the File memory backend if the host fails to create the replacement mapping. The issue is fixed in Firecracker version 1.16.2 and later.
CVE-2026-76806 is a path traversal vulnerability in the open-source time-tracking app solidtime prior to version 0.16.0. The vulnerability arises from improper validation of project ID values read from uploaded ZIP imports, allowing directory traversal outside the intended temporary sandbox. This can lead to creation of directories at arbitrary writable host paths and disclosure of host filesystem layout information. The flaw affects any registered user able to create an organization and perform a specific import API call. The issue is fixed in version 0.16.0.
CVE-2026-97705 is a high-severity vulnerability in the moleculer microservices framework for Node.js. It involves an infinite loop in the TCP transporter parser due to improper handling of a signed packet length. A remote unauthenticated attacker can supply a negative packet length, causing the event loop to block and services to become unresponsive until restarted. This issue affects versions prior to 0.14.36 and 0.15.2 and requires the TCP transporter to be enabled and reachable. The vulnerability is fixed in moleculer versions 0.14.36 and 0.15.2.
CVE-2026-121933 is a critical vulnerability in Linksys E5350 version 1.0.00.037 affecting the Setup Wizard component. The flaw allows remote attackers to bypass authentication by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. Exploit code has been published, but no vendor response or patch is currently available.
Zulip versions from 8.0 up to but not including 12.2 contain a missing authorization vulnerability that allows restricted guest users to access profile information of other users without sending a message. This occurs when the organization setting restricts guests from viewing other users, but saving or editing a direct message draft does not verify sender access to draft recipients. The issue is fixed in version 12.2.
Zulip versions from 11.0 up to but not including 12.2 had a missing authorization check in the GET /json/users endpoint when web-public channels were enabled. This flaw allowed unauthenticated users to access every user's custom profile field values by using the include_custom_profile_fields=true parameter. The issue was resolved in version 12.2.
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.