ECHO-2C86-81C6-C3B3 Dart and Java ME only: TProtocolUtil.skip follows unbounded nesting. Neither binding has a build here (no Dart SDK in Build-Depends, and Java ME has no autotools hook), and no binary package ships them.

Bulletin has no description...

ECHO-2746-22D8-BC1F Dart-only: TJsonProtocol has no string size bound. No Dart SDK is in Build-Depends, and no binary package ships lib/dart.

Bulletin has no description...

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

...

MAL-2026-17492 Malicious code in @angularr/cli (npm)

@angularr/[email protected] impersonates @angular/cli it copies the code and metadata of @angular/cli, including the ng binary and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in @angularr/cli (npm)

@angularr/[email protected] impersonates @angular/cli it copies the code and metadata of @angular/cli, including the ng binary and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

MAL-2026-17463 Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5 The package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload...

Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5 The package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload...

Malicious code in voxel-tts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5 The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxeltts loads voxeltts/harness.py, which...

MAL-2026-17461 Malicious code in voxel-tts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5 The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxeltts loads voxeltts/harness.py, which...

ps5-pihost

PS5 Pi Host Use Raspberry Pi OS Lite 64-bit, Bookworm or ne...

[SECURITY] Fedora 45 Update: wv-1.2.9-43.fc45

Wv is a program that understands the Microsoft Word 6/7/8/9 binary file format and is able to convert Word documents into HTML, which can then be read with a browser...

s24-e1q-root

e1q / Galaxy S24 SM-S921W — exploit root + KernelSU + unatte...

[SECURITY] Fedora 45 Update: hivex-1.3.24-22.fc45

Hive files are the undocumented binary files that Windows uses to store the Windows Registry on disk. Hivex is a library that can read and write to these files. 'hivexsh' is a shell you can use to interactively navigate a hive binary file. 'hivexregedit' in perl-hivex lets you export and merge to...

[SECURITY] Fedora 45 Update: glusterfs-11.2-12.fc45

GlusterFS is a distributed file-system capable of scaling to several petabytes. It aggregates various storage bricks over TCP/IP interconnect into one large parallel network filesystem. GlusterFS is one of the most sophisticated file systems in terms of features and extensibility. It borrows a...

[SECURITY] Fedora 45 Update: fontforge-20251009-6.fc45

FontForge former PfaEdit is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts...

Security update for rustup (important)

openSUSE security update: security update for rustup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22016-1 Rating: important References: bsc1230032 bsc1243862 bsc1249008 bsc1257902 bsc1270186 bsc1270521 bsc1270619 bsc1270644 bsc1270795 bsc1270870...

Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

MAL-2026-17457 Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

OPENSUSE-SU-2026:22016-1 Security update for rustup

This update for rustup fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249008. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve...

SUSE-SU-2026:24014-1 Security update for rustup

This update for rustup fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249008. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve...