Malicious code in consumerweb-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7 The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username os.userInfo.username, hostname...

SUSE CVE-2026-46403

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

SUSE CVE-2026-55737

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-41703

CVE-2026-41703 is an out-of-bounds read vulnerability affecting VMware ESX, Workstation, and Fusion. A malicious actor with VM deployment privileges could trigger memory access violations, potentially leading to information disclosure or, more likely, a DoS on the host process; in Workstation and...

CVE-2026-41703

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service DoS condition of the host process. On Workstation...

CVE-2022-4994

CVE-2022-4994 concerns a Linux kernel KVM/x86 issue where the fast IN path for in-kernel PIO was adjusted. The change routes fast PIO through __emulator_pio_in() directly instead of bouncing via emulator_pio_in(), since __emulator_pio_in() now fills the required value and vcpu->arch.pio.count ...

CVE-2022-4994

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulatorpioin Use emulatorpioin directly for fast PIO instead of bouncing through emulatorpioin now that emulatorpioin fills "val" when handling in-kernel PIO. vcpu-arch.pio.count is guaranteed to be...

CVE-2026-64513

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for x86 architectures. When the apicupdateppr function does not find a deliverable interrupt, it fails to recompute the CR8 intercept, leading to a stale Task Priority Register Threshold TPRTHRESHOLD. This issue can cause a...

CVE-2026-64286

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for arm64 architecture. The flushhypvcpu function, responsible for copying the host virtual CPU vCPU context, does not properly clear a specific internal pointer hyprunningvcpu. This oversight allows a host to provide a value...

PT-2026-66444

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM x86 module where the emulator pio in function was used as a bounce for fast PIO. The fix involves using emulator pio in directly for fast PIO, as emulator pio ...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

EUVD-2026-50440

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-41939

Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...

CVE-2026-64282

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for arm64 architectures. A race condition between the kvmtranslatevncr function and an MMU Memory Management Unit notifier can lead to a Page Frame Number PFN leak. This occurs because an early return in kvmtranslatevncr fail...

CVE-2026-64284

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for x86 systems. This vulnerability occurs when KVM handles fastpath exits, where it may fail to execute vendor-specific cleanup operations before returning control to the virtual machine's userspace. Consequently, memory...

CVE-2026-64287

A flaw was found in the Kernel-based Virtual Machine KVM component of the Linux kernel on ARM64 systems. A highly privileged local attacker could exploit a vulnerability where the system fails to properly restrict memory access during a specific virtual machine operation. This could allow the...

CVE-2026-64288

A flaw was found in the kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. A race condition can occur during the invalidation of the virtual Nested Translation Cache VNCR pseudo-TLB when a virtual CPU vcpu is being brought online or offline. This can lead to a null point...

CVE-2026-16308

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...