MAL-2026-212 Malicious code in lyonscg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6791a364a3883b50ac1feb3bb08141b23eed486a353598186e65a4aa1983cc2c The package lyonscg was found to contain malicious code. Source: ghsa-malware 9610f0b045d1d115ea15f2ebafba8ad33767f1a997a38ed2b85b55a0c58cfdd0 Any...

Malicious code in pako-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b50aeb49929f8ce8f402d5ac0c09ee4735bc5411a45ae75dc357bfc5d18506d The package pako-js was found to contain malicious code. Source: ghsa-malware 86a948a3458aac938e35fbf5ec50b54986362543bef11c481af0f1dd3292cafd Any...

Malicious code in yunxohang11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bcda0e592de29bfcadb36b9fc15f8e9286e6a900d24e8bfc6c377e6ed2c92c1 The package yunxohang11 was found to contain malicious code. Source: ghsa-malware fb0d6761dd8d1cd805af3477c095b5c7acdd92dd5eb9b0aa1c877e65f8ded822 An...

MAL-2026-137 Malicious code in rt-da-classic-card-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40df14bf87fe4eb4e065fda942f953028db00c5e8148c1c1ccc2f6cf623d3611 The package rt-da-classic-card-collection was found to contain malicious code. Source: ghsa-malware...

Malicious code in klywarn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee572661c3786dd95fb006ea7b4d99026b670f00f8e1999c1d961af6d612a2c The package klywarn was found to contain malicious code. Source: ghsa-malware f8ef3f65d8a5142e8b3a669ecd7f5b3891db0031a16d478f7b220fbb41f8d398 Any...

MAL-2026-62 Malicious code in oj-sp-common-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5466d410ace77d36cbf4ad77f4ff2bec3030d7b19266a78de448ef1517b2679 The package oj-sp-common-strings was found to contain malicious code. Source: ghsa-malware...

CVE-2025-14987 Cross Namespace Commands Authorization Bypass

When system.enableCrossNamespaceCommands is enabled on by default, the Temporal server permits certain workflow task commands e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution to target a different namespace than the namespace authorized at...

Malicious code in nbugs-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b87ac16f6f77129a82c79e3e8e1e7a2befb3846cb6824c045fe5203c3f63a3 The package nbugs-video was found to contain malicious code. Source: ghsa-malware 25902a3f4bd357713019e6b42a7e4630aafad4a9a428c91dd406d7dfa883a477 An...

MAL-2025-192629 Malicious code in flagstealerfinal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b9cc9bb0bafe61901221efe8e6c9359eef4061151cc1a35544721addc6b8f2 The package flagstealerfinal was found to contain malicious code. Source: ghsa-malware eecc837f74a9e474ce6f056e83fc505b9f1126d18a96a5eb879def906682fd...

CVE-2025-14761

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

CVE-2025-14760

Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgra...

Amazon S3 Encryption Client 安全漏洞

Amazon S3 Encryption Client is a client-side encryption library open-sourced by Amazon Web Services. A security vulnerability exists in Amazon S3 Encryption Client that stems from a lack of encryption key promises, which could cause a user with write access to an S3 storage bucket to introduce a...

Malicious code in tailwind-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c71a662da2f505a840efadd0fae8fc82d44fe869c688fc1a5f4b7bf4d0a517 The package tailwind-stylecss was found to contain malicious code. Source: ghsa-malware...

Malicious code in elf-stats-aurora-cocoa-911 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ce406834ac9b9cfddc78cc4259b1887fcbd907c2a007295cd47528f8f92deae The package elf-stats-aurora-cocoa-911 was found to contain malicious code. Source: ghsa-malware...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based continuous localization system for free software. A security vulnerability exists in Weblate versions prior to 5.15 that stems from the possibility of accepting invitations opened by different users...

SUSE CVE-2025-65111

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union + and that union references the same relation on both sides but one si...

Malicious code in pymongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85496546788f3cab72ee1fdc5a520ccbd0b64a5a58cdd692f875ab537324c17d The package pymongo was found to contain malicious code. Source: ghsa-malware 09303fe46f98b771f0ffc2e904bd7d979c9b9339b205f41997bfe5435383f232 Any...

MAL-2025-192400 Malicious code in node-calculator-0d96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a218c7694e38a516577be3b65e74e782080f98629b0cc39516beab80562f57b The package node-calculator-0d96 was found to contain malicious code. Source: ghsa-malware...

CVE-2025-32329

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-50616

CVE-2022-50616 relates to the Linux kernel regulator core: a design issue where init data could be allocated on the wrong device due to DT lookups during regulator initialization, creating a potential use-after-free (UAF) when a parent device is released while the regulator core still accesses in...