CVE-2026-83959

Substance3D - Sampler (Adobe) is affected by a Heap-based Buffer Overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction —a victim must open a malicious file. The CVSS 3.1 base score is 7.8 (HIGH) with a local attack ...

MAL-2026-15861 Malicious code in py-1requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6d1a5c78d4368dc76a90cc90a68e4264170ed9ef208c8096251798734bb0d6 py1requests is a typosquat of the popular requests library leading 1 inserted inside the name. On import, py1requests/init.py iterates os.environ and...

MAL-2026-15862 Malicious code in py-2equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd7b93cf88d0fbcca30c50d9c9de6e14134cd2890be5a7a785e9330e98a988c py-2equests is a typosquat of the popular 'requests' package substituting '2' for 'r'. On import py2equests, the top-level module body iterates...

Malicious code in @a23842/dsh-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15879 Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15872 Malicious code in @a23842/dsh-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

MAL-2026-15858 Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

StreamRat Android malware spreads through Meta and TikTok ads

A malicious advertising campaign promoting a fake free TV-streaming service reached roughly 570,000 Meta users. The researchers who discovered the campaign found that its streaming-themed ads were aimed at Spanish-speaking users, with most observed victims located in Spain. One Meta campaign ran...

Malicious code in fieldbase-webapplication-buildtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c30b72acbc526ba924e071ebefd3bc3a131d6dc29abaa71fa76deab2836345e package.json declares preinstall and install lifecycle scripts that collect the installer's username whoami, hostname, current working directory, and...

MAL-2026-15847 Malicious code in fieldbase-webapplication-buildtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c30b72acbc526ba924e071ebefd3bc3a131d6dc29abaa71fa76deab2836345e package.json declares preinstall and install lifecycle scripts that collect the installer's username whoami, hostname, current working directory, and...

EUVD-2026-70466

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...

DEBIAN-CVE-2026-85090

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFXAVC444BITMAPSTREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocate...

MAL-2026-15873 Malicious code in btree-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180c50a02e5bbe5a57f622112bba7f7b01becd6cf85f6d9d4b8301699f4334b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180c50a02e5bbe5a57f622112bba7f7b01becd6cf85f6d9d4b8301699f4334b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...