MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

DEBIAN-CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

AZL-100791 CVE-2026-89762 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

PT-2026-90478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the AppArmor component of the Linux kernel. The problem occurs within the begin current label crit section function, which is called from various Lin...

GO-2026-6433 Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev

Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev...

GO-2026-6346 Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea

Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea...

PYSEC-2026-3917 RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

RestrictedPython guard hooks can be shadowed via positional-only arguments

ImpactRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy.Argument-name...

PYSEC-2026-3840 GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Summary Repo.init forwards kwargs verbatim to git init with no unsafe-option guard and no allowunsafeoptions parameter. git init --template= copies /hooks/ into the new repo's .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary co...

MAL-2026-16118 Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Malicious code in etoro-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c1ceae274b450706288722b9f6c049114593ef2671de93ac58c4fd4a7318c9a On npm install, the package's preinstall lifecycle hook executes preinstall.js, which reads os.hostname, os.userInfo.username, and process.cwd and...

SUSE CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

TALKINGEBN

|-------------------| TALKINGBEN : --- Un malware BootKit que primero realiza una escalada de privilegios en la máquina víctima. Utilizando parcheo en NtTraceEvent y AMSI escáner de búfer de memoria, lo que le permite evadir Windows Defender y cargar un payload sin ser detectado. Luego usamos...

MAL-2026-16097 Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...

CVE-2026-87817

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.init and isgitdir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository...