CVE-2021-4034

CVE-2021-4034 CVE-2021-4034 version available for CentOS 8 Based on modifications from https://github.com/berdav/CVE-2021-4034/tree/main/dry-run Usage Modify the system function in pwnkit-dry-run.c to execute custom commands by default it adds a r00t user with password XHSZWCPU6Nvobe Run make to...

Trigger.dev: Trigger CLI Debug Deployment Logs Expose Resolved Environment Secret Values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with "trigger.dev deploy --env staging --dry-run --log-level debug". The debug output logged the complete build-worker options object. Its "envVars" property contained unredacted...

PT-2026-111194

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

Malicious code in dry-chocolate-parakeet (npm)

Source: amazon-inspector 1ce4ed9a19e46b14c01e8546d308d856477d11f62ee36d04d3ecb582b270bdfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-peach-booby (npm)

Source: amazon-inspector 8bbd81cfa0a7be6a725480beb606ea3136d08a613dc4cfb77eb0174f26a5d479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-rose-iguana (npm)

Source: amazon-inspector 91a486998b80948e010817fdc7e3c5ad31fb7acfe6695ec6ed3eb6a13b896d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-lime-wasp (npm)

Source: amazon-inspector 4bd949be01fec21c88fa5dc61ce98139836b5a7469034cdd62eea5f4aaadadaf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-lavender-primate (npm)

Source: amazon-inspector 9e7e758bf81e20b8507e61ac58020a59d6ea6b36cce89c01d062e0d7e7219931 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-indigo-sole (npm)

Source: amazon-inspector 36dbf98e20619275027fd4151acecaf0ac913787eb11669176a745f6ee4bd1a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-coffee-butterfly (npm)

Source: amazon-inspector d3da734d4809b2e88b3cf1c3b06d695f960941e7104863a29baa267d93ba2e65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-blush-scallop (npm)

Source: amazon-inspector 9281a22366216d332741092eaacb47f80447745047113728180858f304ba9372 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dry-aqua-platypus (npm)

Source: amazon-inspector d0981ddd42f2082dcd5be27dcdade830f3ad6145962ca78a27d85a203a895b17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

SUSE CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

EUVD-2026-54283

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

DEBIAN-CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

UBUNTU-CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...