Malicious code in @rivianlabs/dt-lib-lumberjack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf3a31f76f8c2e22a2792aee30736347d17fe5872cb69c7edaecc7728aa6190 The package @rivianlabs/dt-lib-lumberjack was found to contain malicious code. Source: ossf-package-analysis...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-40934 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-40934 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-35397 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-35397 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory:...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2025-61669 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2025-61669 Source advisory: OSV:PYSEC-2026...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

Copy Fail ARM64 Research CVE-2026-31431 Analysis and ARM64...

kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

Malware authors have traditionally relied on polymorphic techniques to produce variants in the same malware family, complicating signature-based detection. Integrating generative AI into offensive toolchains enables attackers to synthesize structurally diverse payloads with identical behavior,...

angr 9.2.214

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

PT-2026-37315

Name of the Vulnerable Software and Affected Versions ciguard versions 0.6.0 through 0.8.1 Description Both SCA HTTP clients in src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py call the function json.loads on response data without a maximum-bytes cap. A hostile or...

Firmware Distribution As Attack Surface: A Security Study of ASIC Cryptocurrency Miners

ASIC cryptocurrency miners are a core component of blockchain infrastructures, directly converting computation and energy into monetary value. Despite their economic im- portance, their security is rarely evaluated in a structured manner. In this paper, we show that the firmware distribution...

MAL-2026-3331 Malicious code in lazyhtml-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45abfd9582509b7e6ded4a7ce678a25aef82365186bba18330d6f76f1cf3c5ea The package lazyhtml-scripts was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3338 Malicious code in ms.analytics-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8603a11b43db05d179ab55b635a517ed40832c05fc4365a1ba69d2ec1eb5092 The package ms.analytics-web was found to contain malicious code. Source: ossf-package-analysis...

org.apache.opennlp:opennlp-brat-annotator (1.9.5), org.apache.opennlp:opennlp-distr (1.9.5) +4 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.5)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.9.5 - org.apache.opennlp:opennlp-distr 1.9.5 -...

MAL-2026-3329 Malicious code in api-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a549cfdf0cbbfa203632d6fe432f69fa60578b8d81b03b75c2bece912aa0c588 The package api-typings was found to contain malicious code. Source: ghsa-malware adef8d91f5a3e3a45bd82b04eb6b7f4a337d6b88683a0649cf37f92ce111cd57 An...

Malicious code in seek-pass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df5ea10e9459dff09eeff2b45d93b1ffa2458c8b38b7625850b5f2564e3d000f The package seek-pass was found to contain malicious code. Source: ghsa-malware 790b348db4f06f66847a7d527eb269ab55cb230bc6a627c107f47e3d224131f5 Any...

Malicious code in @t-in-one/save_application_hid_to_storage (npm)

Wave 2 of a dependency confusion attack campaign C2: oob.moika.tech targeting internal npm scopes. The attacker npm user t-in-one, email [email protected] published packages at inflated versions that resolve ahead of private registry versions via npm's default version resolution. The campaign...

MAL-2026-3335 Malicious code in @bank-widgets/whats-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83244f927bab36b8e6f6493e932fea1ed017f30aaf286c82a81990f509589934 The package @bank-widgets/whats-new was found to contain malicious code. Source: ossf-package-analysis...

cvapipe-analysis (0.1.4) potentially affected by CVE-2026-7725 via prefect (0.14.15)

prefect PYPI version 0.14.15 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cvapipe-analysis 0.1.4 Source cves: CVE-2026-7725 Source advisory: OSV:GHSA-6RCX-55R6-JX65...

cupyopt (0.14.11.1), fantasy-analysis (>=0.0.0, <=0.0.3) potentially affected by CVE-2026-7725 via prefect (0.14.11)

prefect PYPI version 0.14.11 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cupyopt 0.14.11.1 - fantasy-analysis =0.0.0, =0.0.3 Source cves: CVE-2026-7725 Source advisory: OSV:GHSA-6RCX-55R6-JX65...