MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808d5469c720a0a26411e9def23ca8bf9be60193c696057e2e6378c3ef51640 Package name typosquats the popular fast-csv CSV library but has no CSV functionality. lib/report.js collects the installer's git/GitHub email by...

Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

IBM Db2 db2flacc buffer overflow vulnerability

IBM Db2 is a relational database management system that provides data storage, querying, and management capabilities, supporting enterprise-level applications. There is a buffer overflow vulnerability in IBM Db2. This vulnerability stems from the setgid helper program db2flacc, which fails to...

CVE-2026-10535

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535

IBM Db2 is vulnerable to a stack-based buffer overflow in the setgid helper db2flacc, enabling privilege escalation from an unprivileged shell. Affected products/versions include IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.4 (Linux/Unix; Windows not affected). CVE-2026-10535, CWE-121, has a base CVSS v...

EUVD-2026-51250

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

SUSE CVE-2026-45626

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/id/volumes/volumeName/browse accepts a path query parameter that is passed to a shell command sh -c "find ... | while ..." inside an Arcane helper container. The path...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackhelper. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts t...

PT-2026-66534

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

EUVD-2026-50096

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

MAL-2026-11149 Malicious code in streak-core-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into...

Root-My-Device-Payloads

Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...

Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...

MAL-2026-11118 Malicious code in array-sort-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...