Malicious code in @keyv/encrypt-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb40fe6b9df197abf3018c58ce0ab5a9cdb11d3e9bddc636de1779c5c509948c The package contents produced no a static rule matches and no traced behavior indicating credential access, install-time or import-time code executio...

Malicious code in @keyv/compress-lz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7fac64e01bf267ca0ee1c3234782fd17c24865d3be3e0cbfa26b65fe83c1a3 Package is an LZ4 compression adapter for the keyv key-value store. The dist bundles dist/index.cjs and dist/index.mjs contain Buffer.from...,...

Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

EUVD-2026-52670

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10710

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10710 FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10709 FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10709

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

MAL-2026-11970 Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-11519 Malicious code in launchdarkly-ai-server-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...

Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

firefox: thunderbird: Site isolation issue in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...