11997 matches found
Malicious code in rojo-rbx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...
MAL-2026-16059 Malicious code in rojo-rbx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...
PT-2026-89213
MCP set functype version Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The set functype version MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
EUVD-2026-74594
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
CVE-2026-57825
In opam (OCaml package manager) versions before 2.5.2 , the sandbox protection mechanism can be bypassed due to mishandled symlinks during .install file processing. Specifically, installing files through .install files did not check symlink resolution on the target path, allowing a package to ins...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
Security Advisory 0182
Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
Important: ansible-core security update
Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...
ALSA-2026:66248 Important: ansible-core security update
Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...
CVE-2026-28636
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-69605
Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally...
CVE-2026-28636
A privilege escalation flaw (CWE-269 ) exists in the Documents UI component of Android versions 13, 14, 15, and 16 . The vulnerability is located in setupLayout of PickActivity.java and stems from a confused deputy issue, which allows local applications to bypass the "Install unknown apps" securi...
EUVD-2026-73978
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-73027
Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69605
CVE-2026-69605 is a use-after-free vulnerability in Microsoft Install Service that allows an authorized attacker to perform a local privilege escalation . The flaw is classified with a CVSS 3.1 base score of 7.0 (HIGH) , requiring local access, low privileges, and high attack complexity, with hig...
