CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption

A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data...

gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to...

gimp: integer overflow when generating a thumbnail preview for a PSD file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-75604

A flaw was found in Next.js. When running on Windows systems, the application fails to properly sanitize backslashes in request paths before building file cache locations. An unauthenticated remote attacker can exploit this directory traversal weakness by submitting crafted requests to access...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

MAL-2026-17534 Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17535 Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17540 Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

MAL-2026-17544 Malicious code in @qngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...

MAL-2026-17533 Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

Malicious code in api-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...