11584 matches found
CLSA-2026-1779293372 Update of kernel
New FIPS build for lab review incorporating the els13..35 patches and CVE references...
CLSA-2026-1779289334 Update of kernel
New FIPS build to incorporate els0..els8 patches plus cve references...
Malicious code in @spcsn/taro-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e2baba3a5166ecf1196146e1b2a8771836b25bd7f8d56979e3e277a3de9625 The package's postinstall script probes https://taro.jd.com/ and then invokes its own CLI to run npm install...
MAL-2026-4447 Malicious code in @spcsn/taro-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e2baba3a5166ecf1196146e1b2a8771836b25bd7f8d56979e3e277a3de9625 The package's postinstall script probes https://taro.jd.com/ and then invokes its own CLI to run npm install...
Malicious code in @riskine-frontend/design-elements (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 307db7b976bd8c59b1e8e8247fee9f91ab6a353bf0ae6aa129ceb8e552d6814c @riskine-frontend/[email protected] is a near-empty package whose only effect on install is to pull an external dependency. index.js contains ju...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: The refcount leak in buildfiqaffinity has been fixed. The offindnodebyphandle function returns a node pointer with a refcount incremented. We should use ofnodeput on it when there is no longer a need for it. Ad...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/hdmi: Fixed an issue during the probing of the nvhdmi-mcp driver. After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains its own buildcontrols and buildpcms operations. A...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevents infinite recursion. If the buf + offset is not aligned to XECAHELINEBYTES, we fall back to using a bounce buffer. However, the bounce buffer is allocated on the stack, and the only alignment requirement...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: pinctrl: thunderbay: fixed a possible memory leak in thunderbaybuildfunctions The thunderbayaddfunctions function will free memory associated with thunderbayfuncs when everything is correct. However, thunderbayfuncs will not be...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Fixed pages leaking when building skb in big mode. We attempt to use buildskb if there is sufficient “tailroom”. However, we forget to release the unused pages that are chained via private in big mode, which can lead ...
Malicious code in @tailwind-core/postcss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dab944715339b0fabcf954a92fd33faacbb4d878368c36ea5a7d26d72fe2e56 Package name @tailwind-core/postcss is a one-character-class edit of the official @tailwindcss/postcss Tailwind CSS v4 PostCSS plugin, published unde...
@142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28), @better-builds/turbo-tools (>=6.0.0, <=7.4.4) +10 more potentially affected by CVE-2026-45773 via turbo (>=2.0.1, <=2.9.12)
turbo NPM version =2.0.1, =0.0.3-alpha.19, =6.0.0, =1.0.0, =0.0.234, =0.3.0, =1.5.1, =0.0.0, =0.3.2, =0.5.0, =1.1.0, =1.4.1 - kbc-cinema-custom-app 1.0.0 Source cves: CVE-2026-45773 Source advisory: OSV:GHSA-HCF7-66RW-9F5R...
Malicious code in @tarojs/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...
CVE-2026-33637
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...
Server-side Request Forgery (SSRF)
Overview @haxtheweb/haxcms-nodejs is a HAXcms nodejs backend Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createSite function. An attacker can access internal network resources and read arbitrary files by supplying crafted URLs or file paths to the...
CVE-2026-42096
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about this vulnerability, but didn't respond wi...
CVE-2026-23557
Any guest can cause xenstored to crash by issuing a XSRESETWATCHES command within a transaction due to an assert triggering. In case xenstored was built with NDEBUG defined nothing bad will happen, as assert is doing nothing in this case. Note that the default is not to define NDEBUG for xenstore...
EUVD-2026-30932
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service DoS attack to be executed by sending an specially crafted SQL query. This causes the Pro Cloud Server service to terminate unexpectedly. The vendor was notified early about this vulnerability,...
CVE-2026-42100
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service DoS attack to be executed by sending an specially crafted SQL query. This causes the Pro Cloud Server service to terminate unexpectedly. The vendor was notified early about this vulnerability,...
CVE-2026-42097
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication. The vendor was notified early about this vulnerability, but...