CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

PT-2026-88672

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An injection issue in DevTools allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page...

PT-2026-65408

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions 1.73 through 1.77 Description Three ML-KEM CRYSTALS-Kyber routines perform non-constant-time division of secret-derived polynomial coefficients by the modulus q. The affected routines are Poly.toMsg, which decod...

CVE-2026-67184: NULL Pointer Dereference

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-17524: Improper Limitation of a Pathname to a Restricted Directory

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

PT-2026-93151

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Improper state validation in Skia allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. Skia is a 2D graphic...

PT-2026-93165

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use after free issue in Skia allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page. Use after free is a memory...

SUSE SLES16 Security Update : perl-DBI (SUSE-SU-2026:22845-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22845-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes...

PT-2026-65544

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

Malicious code in chai-as-regulated (npm)

Source: amazon-inspector 67f7f8d21f5d33db136b1e10fc7fbb6d2a1540240911b0630e7fc9f8724c7b26 Package is published as chai-as-regulated, a name mimicking the widely-used chai-as-promised Chai plugin, and the README instructs users to register it via chai.usechaiAsRegulated. The shipped code, however,...

Malicious code in midpatch (npm)

Source: amazon-inspector fe668e556f4b46fce125c318ebc3bea93185c78ec36c19f8991bbcb36172a62b The package advertises a logger middleware keywords fast/logger/stream/json, exports module.exports.pino = middleware, file.js wraps a ./pino module so consumers will install and mount it as Express...

Malicious code in chai-val (npm)

Source: amazon-inspector 515e313c5420dfe9edcb88d61079fa80dbf3539da465572fde5ece42ba6ed748 The package masquerades as a pino-logger helper file structure, exports, and keywords are copied from pino but its main entry exports a middleware that spawns node lib/caller.js as a detached child process...

Malicious code in chai-as-vite (npm)

Source: amazon-inspector b7096b7b983ae63f8e59f9e047440547c9536f6c4c9da0ac46909b91a9d4e10e The package masquerades as a pino-style logger exports module.exports.pino = middleware, keywords fast,logger,stream,json, lib filenames proto.js, redaction.js, multistream.js, transport.js under a name...

Malicious code in weavedb-exm-sdk-web (npm)

Source: amazon-inspector 3992f423f88c69e8c00223cc0ef81f970b8e178f1854beb00ef443586302ad89 package.json declares "preinstall": "./bin/install-deps", which runs a 976KB UPX-packed Linux x86 ELF binary on every npm install. The package self-describes as a pure-JavaScript 'Web Client for WeaveDB' — i...

Malicious code in chai-assert-kit (npm)

Source: amazon-inspector fb347379535c0ea9895e1dc8dd2f20b1fd092b8e62b433bfbd49b2ac1bff2f72 Package name and metadata impersonate the 'chai' assertion library reuses chai's contributors, description, and a 'chaiassert.com' homepage, but the package contains no assertion logic. On require/import,...

Malicious code in chai-as-predicted (npm)

Source: amazon-inspector fd7a2ff71dd341d02986c8185ea9eb18196b782f0efd9103859c0493c9f4cc78 Package name 'chai-as-predicted' impersonates the popular 'chai-as-promised' assertion library, but ships unrelated code disguised as pino logger internals. The exported middleware in index.js spawns a...

Malicious code in zenith-utils (npm)

Source: amazon-inspector c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094 Package name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree lib/nodemailer.js as main, lib/smtp-transport, lib/ses-transport, lib/dkim, lib/mail-composer, etc.; package.json...

Malicious code in based-32 (npm)

Source: amazon-inspector 52ca241d887ed83628c8c4a4432ca0f832d092e6058c7ab4250cc5b169ba7fb9 based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but dist/index.js ships a hidden trigger inside the exported handleSecureEncode function also reachable via the based32 -s CLI...

Malicious code in chai-as-built (npm)

Source: amazon-inspector 469c5ebe97d1e69d080295000d723febbb06050f65aed9a0f44a76fd707c0b1e chai-as-built masquerades as the pino logger package.json keywords 'fast','logger','stream','json'; file layout lib/proto.js, lib/redaction.js, lib/transport.js, lib/multistream.js, lib/levels.js; export...

Malicious code in chai-as-staged (npm)

Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged triggers a detached node child process that runs...