CVE-2026-58088 Race condition in ELF core dump segment counting

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

EUVD-2026-62365

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

CVE-2026-58087 Heap out-of-bounds access in semctl(2)

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

EUVD-2026-62364

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-58087

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-58087 Heap out-of-bounds access in semctl(2)

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-74364

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. Exclusive maps, which are designed to be used by a single program, can be incorrectly inserted as inner maps within a map-in-map structure. This bypasses the intended security checks, allowing an unrelated program to...

Malicious code in node_cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...

MAL-2026-14276 Malicious code in node_cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...

Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

MAL-2026-14277 Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

EUVD-2026-62350

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

MAL-2026-14270 Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

MAL-2026-14271 Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...