Malicious code in test-pkg-yarn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40b74339843ee482f3f135dd43e855f1f30758e20857333e0e6153748888769a package.json declares bin: "node": "./shim.js" , causing npm/yarn to symlink node in nodemodules/.bin and in a system bin dir on global install to a...

MAL-2026-6718 Malicious code in test-pkg-yarn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40b74339843ee482f3f135dd43e855f1f30758e20857333e0e6153748888769a package.json declares bin: "node": "./shim.js" , causing npm/yarn to symlink node in nodemodules/.bin and in a system bin dir on global install to a...

MAL-2026-6717 Malicious code in test-pkg-x0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d0014944456f668a25fa484bf7cb5f36a7128d6a585b86d9294d8d49b23049a Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branches on uname -s...

Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

MAL-2026-6714 Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

MAL-2026-6712 Malicious code in polymarket-risk-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54bfddce038bb64117d6850bb2977f8cee17704212e12e6214fb495b9d4cee79 On npm install, the package's postinstall script reads a config URL from package.json's homepage field...

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

The KILL statement is used to terminate LIVE SELECT subscriptions that capture real-time changes to data within a table. The KILL statement implementation in core/src/expr/statements/kill.rs verifies that the requesting user has database-level access, but does not verify that the requesting user ...

CVE-2026-53467

creationtimestamp| type| source ---|---|--- 2026-07-01 20:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmdenqcm72b 2026-07-02 09:56:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnrbw7ifn22 2026-07-02 11:55:52+00:00| seen|...

Fake Perplexity Chrome extension spies on your searches

Type "Perplexity" into the Chrome Web Store and you get a range of browser extensions offering access to the popular AI search service. Until last week, one of them was called "Search for perplexity ai ," and it delivered something extra that users hadn't bargained for: a small hidden surveillanc...

sigstore-js has Insufficient Verification of Data Authenticity

sigstore-js derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only no signed inclusionPromise/set, and the inclusion proof path does not...

GHSA-XGJW-PM74-86Q4 sigstore-js has Insufficient Verification of Data Authenticity

sigstore-js derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only no signed inclusionPromise/set, and the inclusion proof path does not...

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...

GHSA-MJGF-XJ26-9QF9 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

CVE-2026-58038

creationtimestamp| type| source ---|---|--- 2026-07-01 16:17:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplw6dlatg2v 2026-07-02 02:47:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzdnjc5n2q 2026-07-02 06:47:04+00:00| seen|...

CVE-2026-24260

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering...

CVE-2026-58032

creationtimestamp| type| source ---|---|--- 2026-07-01 16:09:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplvo45xtq25 2026-07-02 02:50:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzjiwlwc22 2026-07-02 07:01:01+00:00| seen|...

acl: TOCTOU Symlink Traversal via getfacl/setfacl

A time-of-check to time-of-use TOCTOU race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes...

CVE-2026-24260

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering...