Malware in tinkoff-cache-path

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the caching mechanism for ld.so removed outdated cache files without properly checking whether the app’s control over the path to the outdated cache was valid within the cache directory. This allowed...

EUVD-2026-66822

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852

CVE-2026-47852 affects Spring AI (versions 1.0.0–1.0.9 , 1.1.0–1.1.8 , and 2.0.0 ). A local attacker on a multi-user host can exploit a predictable (deterministic) cache directory path by pre-creating it and planting a malicious ONNX model file , leading to integrity impact as rated by the vendor...

CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

PT-2026-82350

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 2.0.0 Description A local attacker on a multi-user host can perform cache poisoning by pre-creating a deterministic cache path and planting a malicious ONNX Open Neural Network Exchange model file. ONNX is an...

CVE-2026-66384

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-66384

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

MAL-2026-13574 Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

MAL-2026-13221 Malicious code in bigops-legacy-telephony-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...

MAL-2026-12918 Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-12594 Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

Malicious code in checkout-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g...

Malicious code in streak-core-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e30d02d1e32cea14a74e35046b767fc0f0f5ea6fb5f60958952c2706a8e79c2 On import, the main entry runs a top-level async IIFE that decodes a reversed base64 URL literal to...

Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...