Malicious code in box-sign-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76143eab11057809af00414cb665446366f039e3cbf1fa82aae06a1093cbbf49 [email protected] is a dependency-confusion vehicle positioned against the internal Box namespace @box/sign-client. Its package.json declares a...

MAL-2026-15920 Malicious code in box-sign-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76143eab11057809af00414cb665446366f039e3cbf1fa82aae06a1093cbbf49 [email protected] is a dependency-confusion vehicle positioned against the internal Box namespace @box/sign-client. Its package.json declares a...

Malicious Package

Overview easypanel-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview box-sign-client-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ejs-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview mcp-consultasdeveiculos-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview egstore-graphql-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview box-sign-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

MAL-2026-15896 Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

kernel: smb/client: fix out-of-bounds read in symlink_data()

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability arises from insufficient length validation in the smb2checkmessage function when processing symlink error responses. A remote attacker could exploit this by sending a specially crafted symlink error respons...

kernel: smb: client: fix query directory replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

MAL-2026-15869 Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

EUVD-2026-70814

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

PT-2026-85433

Name of the Vulnerable Software and Affected Versions libsoup versions prior to 3.6.6-9.1 Description A heap use-after-free flaw exists in the HTTP/2 client implementation. This issue occurs when a GNOME application uploads a file using HTTP/2 and the server sends a GOAWAY frame while the file bo...

RHEL 10 : kernel (RHSA-2026:63128)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63128 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcildisc: Clear...

Linux Distros Unpatched Vulnerability : CVE-2026-85024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error...

kernel security update

6.12.0-211.51.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...