Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

Exploit for CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command inject...

Exploit for CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injec...

Exploit for CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via ru...

Exploit for CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dl...

MAL-2026-14360 Malicious code in stillm4ddpocs-demo-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...

Malicious code in stillm4ddpocs-demo-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...

[SECURITY] [DSA 6459-1] libnet-dns-perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6459-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 22, 2026 https://www.debian.org/security/faq -...

Exploit for CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Direc...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...

DEBIAN-CVE-2026-74721

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

DEBIAN-CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74721

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

CVE-2026-74728

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

DEBIAN-CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

DEBIAN-CVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...