Malicious code in @simplipayng/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c The bundled main dist/index.js executes an evalatob... blob at module top level, so any Node-side require of the package SSR, tests, Next.js server...

PT-2026-68424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Intel IOMMU driver allows Shared Virtual Addressing SVA on devices that do not support PCI Page Request Interface PRI. While the SVA bind path was updated to skip Input/Output Page...

PT-2026-68423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dma-buf/udmabuf component where importing a udmabuf into a DRM driver triggers a spurious cacheline tracking warning when CONFIG DMA API DEBUG SG is enabled. This...

CVE-2026-64591: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...

CVE-2026-64590: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...

Linux Distros Unpatched Vulnerability : CVE-2026-64590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu...

CVE-2026-64590

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...

CVE-2026-64591

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...

CVE-2026-17679 vulnerabilities

Vulnerabilities for packages: chromium...

Malicious Package

Overview @zzzgenesis00/spl-token-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

SummaryJSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a deprecati...

EUVD-2026-52606

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown

A flaw was found in the Linux kernel. A race condition exists in the timershutdownsync function, where a timer's function pointer can be set to NULL while the timer is still active on another processor. This can be exploited by a local attacker to trigger a kernel warning, potentially leading to...

CVE-2026-18720 kalcaddle kodbox msgWarning Plugin action improper authorization

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

CVE-2026-18720

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

PT-2026-67126

Name of the Vulnerable Software and Affected Versions Thermo Fisher Applied Biosystems Genetic Analyzers affected versions not specified Description Output files with .fsa or .hid extensions can be edited, allowing an attacker to tamper with DNA data. This could lead to inaccurate DNA test...

Malicious Package

Overview @sw-commons-components/message-upsell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview @0xlr/question-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview asdsafsafdasdsaasdasda is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @patternfly-4/react-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...