92673 matches found
GHSA-FR26-JJHM-638C pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
Summary UnTar.safeextractall — the hardening added for GHSA-mvwx-582f-56r7 — validates member names and symlink/hardlink targets, but never checks member types, and calls tarfile.extractall without a filter=. On Python : names/links only raise ArchiveError... tar.extractallpath, members,...
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
Summary UnTar.safeextractall — the hardening added for GHSA-mvwx-582f-56r7 — validates member names and symlink/hardlink targets, but never checks member types, and calls tarfile.extractall without a filter=. On Python : names/links only raise ArchiveError... tar.extractallpath, members,...
MAL-2026-17744 Malicious code in kmf-vendor-pack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6e1c289f2890e0e06ab31a8d6cf5dbc8deabc26054cb44a0c60295c29a74506 [email protected] is a dependency-confusion lure. package.json declares postinstall: node postinstall.js, which requires a shipped prebuilt...
Malicious code in @galicia-toolkit-nestjs/swagger (npm)
Source: amazon-inspector 605d8d8afe172d78840f3617c35733b47635a3482beba461bc1015c45840e250 The package presents itself as a NestJS Swagger integration name resembles @nestjs/swagger, published at version 999.0.2 in a dependency-confusion shape but ships a stub JavaScript API forRoot/createLogger...
Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)
Source: amazon-inspector 662603823964bdbc871f386498e949d768c84d99645690ee3b5e904b458536db On module load, index.js unconditionally requires a bundled native binary at prebuilds/-/metrics.node inside a try/catch that swallows errors. The ELF reads installer-side credential-grade environment...
CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The...
UBUNTU-CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The...
CVE-2026-95702
A use-after-free vulnerability exists in the VFS component of Google gVisor prior to release 20260831.0 on all platforms. A local attacker with standard container privileges can achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay f...
CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...
CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...
EUVD-2026-95783
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...
MSC-2026-12727
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12717
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12721
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12720
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12724
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12695
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12698
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-12723
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12725
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...