7793 matches found
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
OESA-2026-4154 glibc security update
The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...
OESA-2026-4155 glibc security update
The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...
Malicious Package
Overview fabric-loader-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview epic-ticket-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview contoso-login-sim-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
MAL-2026-17322 Malicious code in contoso-login-sim-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ce76699c91a883d24e3ad609bb04faa3f52cbeaecfb24c1c3bcde8b496a5c Package ships a single 138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine zc with a...
Malicious code in contoso-login-sim-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ce76699c91a883d24e3ad609bb04faa3f52cbeaecfb24c1c3bcde8b496a5c Package ships a single 138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine zc with a...
Malicious code in tailwind-forms-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...
MAL-2026-17310 Malicious code in tailwind-forms-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...
AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2026:1777397602)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777397602 advisory. - A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by- one error. A remote attacker coul...
SUSE CVE-2026-102566
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...
SUSE CVE-2026-102567
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...
Malicious code in fs-commons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b The package presents itself as a filesystem/data-helper library, but its exported getTransactions/loadtransactiondata functions are a two-file...
CVE-2026-102711
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...
Malicious code in fabric-loader-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...
MAL-2026-17306 Malicious code in fabric-loader-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...
CVE-2026-102711
The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...
CVE-2026-102711
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...
EUVD-2026-89174
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...