Malicious code in lsh (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0 The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 crates.io as malicious. It is considered malicious because: - The package...

MAL-2026-3126 Malicious code in lsh (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0 The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 crates.io as malicious. It is considered malicious because: - The package...

Medoid Prototype Alignment for Cross-Plant Unknown Attack Detection in Industrial Control Systems

Deploying an intrusion detector trained in one industrial plant to another remains difficult because Industrial Control System ICS traffic is highly site-dependent, labels are scarce, and unseen attacks often appear after deployment. To address this challenge, this paper introduces a medoid...

Zyxel DX3301-T0和Zyxel EX3301-T0 操作系统命令注入漏洞

Both the Zyxel DX3301-T0 and Zyxel EX3301-T0 are products of the Chinese company Zyxel. The Zyxel DX3301-T0 is a small wireless WiFi router. The Zyxel EX3301-T0 is a secure routing gateway. Both the Zyxel DX3301-T0 and Zyxel EX3301-T0, including versions 5.50ABVY.7.1C0 and earlier, have an...

PT-2026-35750

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.2 through 2.33 GNU C Library version 2.34 affected versions not specified Description The deprecated functions ns printrrf, ns printrr, and fp nquery fail to validate RDATA content against the RDATA length in a DNS...

OpenClaw 访问控制错误漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.31 contained a access control vulnerability, which was caused by a wide-area discovery vulnerability. This vulnerability allowed arbitrary tailnet peers to be accepted as DNS...

MARD: A Multi-Agent Framework for Robust Android Malware Detection

With the rapid evolution of Android applications, traditional machine learning-based detection models suffer from concept drift. Additionally, they are constrained by shallow features, lacking deep semantic understanding and interpretability of decisions. Although Large Language Models LLMs...

PT-2026-35871

Name of the Vulnerable Software and Affected Versions xen affected versions not specified Description Security issues were identified and addressed in the xen-4.21.1 04-1.1 package on the GA media of openSUSE Tumbleweed. Recommendations Update to the xen-4.21.1 04-1.1 package...

CLSA-2026-1777321102 Fix CVE(s): CVE-2022-26923, CVE-2022-32743

SECURITY UPDATE: Samba AD DC did not enforce the Validated-DNS-Host-Name write right, allowing an unprivileged authenticated user with machine account write access e.g. SeMachineAccountPrivilege to set the dNSHostName attribute to an arbitrary value, bypassing the MS-ADTS requirement that it matc...

Exploit for Improper Access Control in Nodejs Node.Js

CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass...

CVE-2026-42254

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response...

MAL-2026-3104 Malicious code in robase-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9ca93a110c410fd6294e5270289bebb1872f9b81152d837f4990756881646cc0 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-3103 Malicious code in amzn_codewhisperer_streaming_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8 The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 crates.io as malicious. It is considered maliciou...

Malicious code in amzn_codewhisperer_streaming_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8 The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 crates.io as malicious. It is considered maliciou...

Malicious code in amzn_consolas_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91 The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: - Th...

MAL-2026-3101 Malicious code in amzn_consolas_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91 The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: - Th...

MAL-2026-3102 Malicious code in semantic_search_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: -...

Malicious code in semantic_search_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: -...

freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

A null pointer dereference has been discovered in FreeRDP. A NULL pointer dereference vulnerability in rdpwritelogoninfov2 allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0...

BIT-MASTODON-2026-41259 Mastodon: Insufficient verification of email addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted...