Malicious code in 3layerdipstacka1fnr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98b72414c1cd24b6c0ff2136df8fba54095af4f033fe29c2718f32762f0339ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstacku0rsp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d98b92cd88db1a4a38622d009e03f436231346790628e797c575a0f1d23989f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14643 Malicious code in 3layerdipstack6jqkjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3282758727328d8477c022b3347d6a69f149c13a840749cbd71039d28b7aeeb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14854 Malicious code in 3layerdipstackobk93q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f10fd4f721af0eac918746c4dcde96ec112c5c7676c3a851cccf71c9f1e378 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackk5ewlo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0be1dcacd3491d48fd7d39459b01ebcd86aca30f25b13b54f663f6229039f70f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14955 Malicious code in 3layerdipstackv4z5q (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a98409130dc64be128e84db128df54960dc16a9b6f0fc1a71e7f8665a60298e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15013 Malicious code in classlink-2ls71exe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d170267670e89894c46e73313388269e7870004535351faf878d8e8070587ce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-zgfuyabx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f86dbdaa63c96ad793223581d0e5df4ea82326d9e92a808dfbea81bcd4534e1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ggbh6tng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd4edd79ce6ac910c2bd864624e532a72b39bf24106a2ea33dca8657f0e1ec6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fongsidev/scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c7391aa8a431e807fe8cf8b22ad7a1073422de03f6c1ce923054ea9f3c3faf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-16933 Power System Integer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 through OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker...

CVE-2026-17429 Power System Incorrect Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with...

pygrub is only supported in de-privileged mode

ISSUE DESCRIPTION XSA-443 and XSA-497 addressed specific issues in specific file system drivers libfsimage used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de-privileged. Only this mode of operation is security supported from...

MAL-2026-10745 Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

CVE-2026-44161

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd outhttp output plugin allows placeholders such as $tag in the endpoint configuration parameter, and if a placeholder value is derived from untrusted...

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

The outhttp output plugin allows the use of placeholders such as $tag in the endpoint configuration parameter. It was discovered that if the placeholder value is derived from untrusted user input, an attacker can maliciously control the destination hostname of the outbound HTTP requests made by...

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery SSRF vulnerability. This vulnerability is mitigated by the fact that an attacker must have the access to change the host url...

CVE-2026-47135

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox...

CVE-2026-46032

Summary: CVE-2026-46032 relates to Linux kernel KVM nSVM, where a failed restore of L1 host CR3 during a nested VMEXIT could leave L1 with corrupted state and trigger a triple fault instead of a clean recovery. The fix removes the nested_svm_vmexit return value and ensures proper cleanup, resulti...

EUVD-2026-32413

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Triple fault if restore host CR3 fails on nested VMEXIT If loading L1's CR3 fails on a nested VMEXIT, nestedsvmvmexit returns an error code that is ignored by most callers, and continues to run L1 with corrupted state....