1900138 matches found
CVE-2026-75589
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...
DEBIAN-CVE-2026-75589
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...
CVE-2026-58087
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-58088
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...
Malicious code in localize-translate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...
MAL-2026-14279 Malicious code in localize-translate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...
Malicious code in mutex-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...
MAL-2026-14282 Malicious code in mutex-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...
CVE-2026-58088 Race condition in ELF core dump segment counting
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...
CVE-2026-58088
Affected: All supported FreeBSD versions. Root cause: A race condition in ELF core dump code — a second-pass write to the program-header buffer is not bounds-checked against the count from the first pass, so a process sharing the address space via rfork(2) can mutate the VM map between passes. Im...
CVE-2026-58088 Race condition in ELF core dump segment counting
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...
EUVD-2026-62365
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...
CVE-2026-58087 Heap out-of-bounds access in semctl(2)
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
EUVD-2026-62364
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-58087
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-58087 Heap out-of-bounds access in semctl(2)
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-74364
A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. Exclusive maps, which are designed to be used by a single program, can be incorrectly inserted as inner maps within a map-in-map structure. This bypasses the intended security checks, allowing an unrelated program to...
Malicious code in node_cryptography (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...
MAL-2026-14276 Malicious code in node_cryptography (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e10a704c94a9f7a4f6344a67e3867cd87b21be574e81bbdccdc6b5ca48f65a2 The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptographic or wallet material to i...
MAL-2026-14277 Malicious code in o0o9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...