UBUNTU-CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...

UBUNTU-CVE-2026-115385

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds...

UBUNTU-CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

PT-2026-123418

The Bluetooth host pre-allocates a bt conn object a "reservation" from the fixed acl conns pool for every connectable advertising set it starts, in le adv start add conn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, find pending connect in...

SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection

Host-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every conclusion they draw therefore rests on assumptions about clocks, delivery, entity identity and the integrity of the evidence, and most of these assumptions go unstated. This...

PT-2026-125534

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...

UBUNTU-CVE-2026-115377

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs...

PT-2026-123338

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the...

UBUNTU-CVE-2026-115892

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or...

CVE-2026-80765

A flaw was found in the Linux kernel's Hyper-V synthetic Human Interface Device HID host. A malicious Hyper-V host or backend can send a specially crafted initial device information message to a guest system. This message, containing an oversized HID report descriptor length, can cause the guest ...

Malicious code in zagents-message-bus (PyPI)

Source: kam193 0d1891d5d76adad51e120baa41752f0cc878b243eb400e7a12aba1616d31d1f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Docker Container Command Execution Tool A powerful Docker remote API exploitation tool for security research and testing of CVE-2025-9074 vulnerability. Core Advantages ✅ Fully automated container lifecycle management : Automatically creates temporary containers, cleans up after...

Malicious code in @ppa-web-components/ppa-searchform (npm)

Source: amazon-inspector c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require. On execution it collects host identifiers hostname, install path, current...

Malicious code in @greenlake/common-context (npm)

Source: amazon-inspector 5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e @greenlake/[email protected] is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both scripts.postinstall node beacon.cjs and require of the ma...

Malicious code in @drone-js-ext/core (npm)

Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in cleartext to the hardcoded bare-IP endpoint...

Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

MAL-2026-18273 Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...