kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done()

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handleauthdone Perform an explicit bounds check on payloadlen to avoid a possible out-of-bounds access in the callout. idryomov: changelog...

Malicious code in @mastra/auth-better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f3ba577912ece34e70e0f5d94ee38bf681dc3f0d2a2125d0bbe95c98dbbe3a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6000 Malicious code in @mastra/auth-better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f3ba577912ece34e70e0f5d94ee38bf681dc3f0d2a2125d0bbe95c98dbbe3a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in @mastra/auth-better-auth

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @mastra/auth-workos

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @mastra/auth-workos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fda21074dd42e87b39d51daa2005f7387067b9d8cd59742a05eec6515e40643 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6003 Malicious code in @mastra/auth-workos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fda21074dd42e87b39d51daa2005f7387067b9d8cd59742a05eec6515e40643 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in @mastra/auth-auth0

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @mastra/auth-supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a427f1046e59190d3e1679863dad8dadb7ea1c5b14f0b2dd2b21f586d13ab4e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6002 Malicious code in @mastra/auth-supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a427f1046e59190d3e1679863dad8dadb7ea1c5b14f0b2dd2b21f586d13ab4e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in @mastra/auth-supabase

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @mastra/auth-clerk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d80aa3e2beb7b80c5c0ab6155ebf33290b48d7e23a97f7dc5e2f7bc288d5e84f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in @mastra/auth-clerk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @mastra/auth

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @mastra/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918dd16aca072972c93ebb866b08d6d5fda0b443955a2d4589ecbdbf4b87539 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5940 Malicious code in @mastra/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918dd16aca072972c93ebb866b08d6d5fda0b443955a2d4589ecbdbf4b87539 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-50429

Name of the Vulnerable Software and Affected Versions NGINX Gateway Fabric affected versions not specified Description An injection issue exists in the NGINX configuration generator component when NGINX Plus is used as the data plane. User-supplied string values from the serverTokens field of the...

PT-2026-50561

Name of the Vulnerable Software and Affected Versions bbot affected versions not specified Description The docker pull module fails to validate the realm parameter received from a Docker registry's WWW-Authenticate response header when using it as the authentication endpoint. A man-in-the-middle...

GHSA-9R5X-WG6M-X2RC Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only read:user can use the same token as Authorization: Basic base64:x-oauth-basic and perform write actions, including...

MAL-2026-5934 Malicious code in ssr-auth-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe43338279cb894ffacc18ef9ec757d4b4fa8b603672b0bedcb4c00d9f8a806 On require'ssr-auth-sync', index.js loads lib/writer.js, which immediately fetches a base64-hidden URL https://www.jsonkeeper.com/b/PJNZP, an anonymo...