Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

MAL-2026-12067 Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

Malicious code in ckcc-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebcdc07616ec6ab418a9005e1486d05f3753dc4d37f6ce61c5daed495d31e25 The npm package [email protected] typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality index.js exports . Its...

Important: Red Hat Security Advisory: Migration Toolkit for Applications

A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

The widespread adoption of open source software OSS has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods,...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable

Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them. The vendor's July 31 security bulletin says nearly undetectable changes to .fsa and .hid outputs could occur if...

Joern 4.0.594

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

The vulnerability of the qs.stringify() function in the string query analysis and transformation library allows a attacker to cause a service failure.

The vulnerability of the qs.stringify function in the string query analysis and conversion library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the ROHC analyzer in Wireshark allows a hacker to cause a service failure.

The vulnerability of the ROHC analyzer in Wireshark, which is responsible for analyzing network traffic, relates to pointer manipulation. Exploiting this vulnerability can allow attackers to cause service interruptions...

UBUNTU-CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

EUVD-2024-55704

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

CVE-2024-40683 affects IBM Operations Analytics – Log Analysis. The TOCTOU weakness in the built-in password management causes sessions not to be invalidated after a password change, potentially enabling an authenticated user to impersonate another user. Affected versions include 1.3.5.0–1.3.7.2 ...

CVE-2026-4978

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection. This issue affects Traffic Analysis System: from 30 before 34...

CVE-2026-4978

CVE-2026-4978 describes an SQL injection in UMAI Vision Traffic Analysis System. The vulnerability arises from improper neutralization of special elements in SQL commands. Affected software: Traffic Analysis System (listed as: from 30 before 34). CVSS v3.1 base metrics indicate a critical impact ...