MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

SUSE CVE-2026-59087

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker ...

Fake CCleaner installs GhostDesk Chrome spyware

A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk, which acts as spyware inside the browser. With more than 2 billion downloads worldwide, CCleaner is one of the best-known Windows utilities, making it ...

Malicious Package

Overview safe-local-env-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-internal-svg-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

MAL-2026-13741 Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

MAL-2026-13766 Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

CVE-2026-73067

CVE-2026-73067 affects the Tesseract OCR engine. A crafted .traineddata model loaded via TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg to accept an unterminated forward-edge run, leading to SquishedDawg::Load calling num_forward_edges(0) and last_edge reading beyond edges_, which t...

CVE-2026-73067 Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

CVE-2026-73067 Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

CVE-2026-73067 Tesseract: Heap OOB read in the DAWG loader

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

binfmt_elf_fdpic: only honour the first PT_INTERP

...

[SECURITY] [DLA 4730-1] libyaml-syck-perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4730-1 [email protected] https://www.debian.org/lts/security/ Salvatore Bonaccorso August 10, 2026 https://wiki.debian.org/LTS -...

DEBIAN-CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

EUVD-2026-55743

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

EUVD-2026-55697

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71968 OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...