gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to...

CVE-2026-75604

A flaw was found in Next.js. When running on Windows systems, the application fails to properly sanitize backslashes in request paths before building file cache locations. An unauthenticated remote attacker can exploit this directory traversal weakness by submitting crafted requests to access...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

MAL-2026-17534 Malicious code in @angjlar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9 Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description 'Angular - the core framework', auth...

Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17535 Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17540 Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

MAL-2026-17544 Malicious code in @qngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...

Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17533 Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

Malicious code in api-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

Malicious code in express-enhanced (npm)

Source: amazon-inspector 15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6 [email protected] impersonates the express package: it ships the express README verbatim, declares TJ Holowaychuk as author, and points repository at expressjs/express, while publishing under a differen...

Malicious code in dotenv-promises (npm)

Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API config/parse/populate/expand to attract installs of a...

Malicious code in dotenv-async (npm)

Source: amazon-inspector 51d22963a1f1fabe3a8b3f54efcb5053761d385486093200765745297ac2bd16 The package impersonates the dotenv API but on module load and again when the bundled CLI runs invokes a function named dispatchAnalytics in dist/index.cjs that extracts a payload from the APP14 0xFFED marke...

Malicious code in studiocode_eligibility (npm)

Source: amazon-inspector a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc package.json declares a postinstall hook wscript.exe 4444.vbs that automatically executes a 765KB VBScript shipped in the tarball on Windows installers. The VBS contains multi-layer obfuscation XOR-decoded A...