Malicious code in streak-day-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive...

Malicious code in streak-count-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...

MAL-2026-11139 Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...

CVE-2026-63833

A flaw was found in the Linux kernel's ntfs3 filesystem driver. An unprivileged local user with write access to an ntfs3 mounted filesystem can exploit a vulnerability by directly modifying internal Windows Subsystem for Linux WSL permission metadata. This manipulation allows the user to gain roo...

CVE-2026-63833

The CVE-2026-63833 issue affects the Linux kernel ntfs3 module: an unprivileged user on a writable NTFS3 mount could abuse the empty-prefix xattr handler to write to reserved $LX* attributes, enabling planting root ownership and S_ISUID on their file and obtaining effective user ID 0 after inode ...

CVE-2026-63833 ntfs3: reject direct userspace writes to reserved $LX* xattrs

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid and imode from ntfsgetwslperm. Because the empty-prefi...

EUVD-2026-43904

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally...

CVE-2026-57973

Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...

CVE-2026-57968

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

CVE-2026-57968

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

CVE-2026-57973

Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...

CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

...

CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

...

CVE-2026-57973

CVE-2026-57973 describes a Time-of-check Time-of-use (TOCTOU) race condition in Windows Subsystem for Linux (WSL2) kernel. The issue allows an authorized attacker to perform local tampering. Affected component is the WSL2 kernel; impact per sources is local, with confidentiality and integrity aff...

CVE-2026-57968

The CVE-2026-57968 entry describes a Buffer over-read in Windows Subsystem for Linux (WSL2) that can enable local privilege escalation for an authorized attacker. Connected sources corroborate a kernel-level issue affecting WSL2; the base CVSS vector indicates LOCAL attack, LOW complexity, with H...

CVE-2026-57968 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

...

CVE-2026-57968 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

...

Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

KLA91148 Multiple vulnerabilities in Microsoft Open Source Software

Multiple vulnerabilities were found in Microsoft Open Source Software. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Windows Subsystem for Linux WSL2 Kernel can...

Microsoft Windows Subsystem for Linux (WSL2) < 2.7.10 Tampering (CVE-2026-57973) (July 2026)

The version of Microsoft Windows Subsystem for Linux WSL2 on the remote Windows host is prior to 2.7.10. It is, therefore, affected by a tampering vulnerability: - Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering...