GHSA-XW8C-RRVX-F7XQ ciguard: SCA HTTP client reads response body without size cap

Summary Both SCA HTTP clients src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call payload = json.loadsresp.read.decode'utf-8' without a maximum-bytes cap. A hostile or compromised endoflife.date / OSV.dev or a successful TLS MITM could return a multi-GB response,...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40110 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40110 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40934 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40934 Source advisory: OSV:PYSEC-2026...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-35397 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-35397 Source advisory: OSV:PYSEC-2026...

Malicious code in @rivianlabs/dt-shop-bag-v0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4117faebfc77cf01d1cf1bb6e5c6c2e9dda679d8f976eb5308a585016f3f5f The package @rivianlabs/dt-shop-bag-v0 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @rivianlabs/dt-lib-lumberjack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf3a31f76f8c2e22a2792aee30736347d17fe5872cb69c7edaecc7728aa6190 The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code. Source: ossf-package-analysis...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40934 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40934 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-35397 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-35397 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory: OSV:PYSEC-2026...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

Copy Fail ARM64 Research CVE-2026-31431 Analysis and ARM64...

kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

Firmware Distribution As Attack Surface: A Security Study of ASIC Cryptocurrency Miners

ASIC cryptocurrency miners are a core component of blockchain infrastructures, directly converting computation and energy into monetary value. Despite their economic im- portance, their security is rarely evaluated in a structured manner. In this paper, we show that the firmware distribution...

PT-2026-37315

Name of the Vulnerable Software and Affected Versions ciguard versions 0.6.0 through 0.8.1 Description Both SCA HTTP clients in src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call the function json.loads on response data without a maximum-bytes cap. A hostile or...

angr 9.2.214

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

Malware authors have traditionally relied on polymorphic techniques to produce variants in the same malware family, complicating signature-based detection. Integrating generative AI into offensive toolchains enables attackers to synthesize structurally diverse payloads with identical behavior,...

MAL-2026-3331 Malicious code in lazyhtml-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45abfd9582509b7e6ded4a7ce678a25aef82365186bba18330d6f76f1cf3c5ea The package lazyhtml-scripts was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3338 Malicious code in ms.analytics-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8603a11b43db05d179ab55b635a517ed40832c05fc4365a1ba69d2ec1eb5092 The package ms.analytics-web was found to contain malicious code. Source: ossf-package-analysis...

org.apache.opennlp:opennlp-brat-annotator (1.9.5), org.apache.opennlp:opennlp-distr (1.9.5) +4 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.5)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.9.5 - org.apache.opennlp:opennlp-distr 1.9.5 -...

MAL-2026-3329 Malicious code in api-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a549cfdf0cbbfa203632d6fe432f69fa60578b8d81b03b75c2bece912aa0c588 The package api-typings was found to contain malicious code. Source: ghsa-malware adef8d91f5a3e3a45bd82b04eb6b7f4a337d6b88683a0649cf37f92ce111cd57 An...