166686 matches found
kernel: drm/amdgpu/vce: fix integer overflow in image size
A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...
CVE-2026-84333
A flaw was found in Dawn, a component of Google Chrome on Android. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside of the browser's sandbox, allowing the attacker to gain...
CVE-2026-79195
A flaw was found in Chromium. A remote attacker could exploit a use-after-free vulnerability within the Script component. By enticing a user to visit a specially crafted HTML page, the attacker could execute arbitrary code inside the sandbox...
CVE-2026-87509
A flaw was found in the Google Chrome Updater. This incorrect authorization vulnerability allows a local attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by exploiting the flaw through a local program, leading to unauthorized code execution on the...
MGASA-2026-0450 Updated python-gitpython packages fix security vulnerabilities
Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...
Updated python-gitpython packages fix security vulnerabilities
Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...
Malicious code in agency-testts (npm)
Source: amazon-inspector ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a 674KB script containing large opaque base64 blobs and an AES key/IV...
Malicious code in agency-test-exercise (npm)
Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base64 string array ArtifactBundleHX that is reassembled and...
Malicious code in n8n-nodes-moonlet-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...
MAL-2026-17176 Malicious code in n8n-nodes-moonlet-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec Package presents itself as n8n helper nodes but ships an empty stub index.js module.exports = and no functional node modules. On npm install,...
USN-8822-1: Libwebsockets vulnerabilities
It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...
USN-8822-1 libwebsockets vulnerabilities
It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...
MAL-2026-17171 Malicious code in agency-testts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a 674KB...
Malicious code in agency-testts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that auto-runs on npm install on Windows. The bundled 4444.vbs is a 674KB...
Malicious code in agency-test-exercise (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...
MAL-2026-17170 Malicious code in agency-test-exercise (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...
OESA-2026-4098 flatpak security update
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fixes: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on th...
OESA-2026-4074 flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the...
OESA-2026-4065 freeipmi security update
The package provides "Remote-Console" and "System Management software" based on intelligent platform management interface specification. Security Fixes: FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in...
OESA-2026-4061 python-templated-dictionary security update
Dictionary where getitem is run through Jinja2 template. Security Fixes: The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of prope...