Malicious Package

Overview link-update-jwt-chai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-94494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf and xdp components where bpf xdp link update calls dev xdp install directly, bypassing the checks performed in dev xdp attach. This allows a user to create an...

PT-2026-94741

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the bpf netns link update prog function. The issue occurs because checks for old prog and program type are performed without locking before the netns bpf mutex...

The vulnerability of the led_get() function in the drivers/leds/led-class.c module, which supports Linux LED devices, allows a attacker to cause a service failure.

The vulnerability of the ledget function in the drivers/leds/led-class.c module related to Linux LED support in the Linux kernel is associated with errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260826-73-0012

The vulnerability of the initbiosattributes function in the drivers/platform/x86/dell/dell-wmi-sysman/sysman.c file of the Linux kernel device driver for X86 processors is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-72615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the replace effective prog and purge effective progs functions incorrectly locate slots in the effective array when BPF F PREORDER programs are...

The vulnerability of the pci_get_dev_wrapper() function in the drivers/edac/i10nm_base.c file of the EDAC driver for the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the pcigetdevwrapper function in the drivers/edac/i10nmbase.c file of the EDAC driver for the Linux operating system is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-35516 LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services AWS IMDSv1, cloud metadata, internal APIs by creating a link with a publ...

PT-2026-30864

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services AWS IMDSv1, cloud metadata, internal APIs by creating a link with a publ...

The vulnerability of the octeon2_usb_clocks_start() function in the arch/mips/cavium-octeon/octeon-platform.c module, which is part of the Linux operating system’s MIPS architecture support, allows a hacker to cause a service failure.

The vulnerability of the octeon2usbclocksstart function in the arch/mips/cavium-octeon/octeon-platform.c module, which is part of the Linux operating system’s MIPS architecture support, is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a servi...

The vulnerability of the sifive gpio_probe() function in the drivers/gpio/gpio-sifive.c file of the Linux kernel’s GPIO driver allows a hacker to cause a service failure.

The vulnerability of the sifivegpioprobe function in the drivers/gpio/gpio-sifive.c file of the Linux kernel’s GPIO driver is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `init_bios_attributes()` function in the drivers/platform/x86/dell/dell-wmi-sysman/sysman.c driver for X86 kernel-based Linux devices allows a attacker to cause a service failure.

The vulnerability of the initbiosattributes function in the drivers/platform/x86/dell/dell-wmi-sysman/sysman.c file of the Linux kernel device driver for X86 processors is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-3741

A security vulnerability has been detected in YiFang CMS 2.0.5. The affected element is the function update of the file app/db/admin/DfriendLink.php. Such manipulation of the argument linkName leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed...

CVE-2023-49375

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/friendlink/update...

Malicious code in sails-link-update-glaciology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c565b4c6d9dd5485fafd3fce71a661cbee1ead7dd64f7bb8d20006fbbcbc76e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176545

Malicious code in sails-link-update-glaciology npm...

EUVD-2025-111685

Malicious code in link-update-jwt-chai npm...

EUVD-2025-114563

Malicious code in deneb-link-update-deneb npm...

MAL-2025-141546 Malicious code in deneb-link-update-deneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d9c4475b482ba822ab66700268c35909301fd11e9793500dc71c7e483a8395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-34813 · Mahara · Mahara

Name of the Vulnerable Software and Affected Versions: Mahara versions 23.04.8 and 24.04.4 Description: An issue allows an attacker to download files without proper authorization by using a malicious export download URL. Recommendations: Update to a newer version that contains a fix for this issu...