Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

MAL-2026-10991 Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

hulak v0.3.30

Git-native API client with encrypted secrets. REST · GraphQL · OAuth Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive root@kitploit: hulak run ./requests/ Hulak runs request files directly from your project. It supports...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...

CVE-2026-60266

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracl...

CVE-2026-47001

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Web Services Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

CVE-2026-46988

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Connector Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

CVE-2026-63940

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit...

CVE-2026-63938

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV feature. When processing Page State Change PSC requests, the system does not properly validate the PSC buffer against the effective size of the scratch area. This can occur if a guest...

CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block GHCB scratch area. When processing Page State Change PS...

CVE-2026-63937

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV. This time-of-check to time-of-use TOCTOU vulnerability exists when KVM processes the guest-accessible Page State Change PSC buffer. A misbehaving guest could exploit this timing issue...

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

SUSE CVE-2026-63940

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

CVE-2026-64104

A flaw was found in the Linux kernel's SEV-ES Secure Encrypted Virtualization-Encrypted State guest module. When memory encryption or decryption operations fail, the affected memory pages can be left in an unknown or unencrypted state. This could lead to information disclosure, as these pages are...

Amazon Linux 2 : golang, --advisory ALAS2-2026-3819 (ALAS-2026-3819)

The version of golang installed on the remote host is prior to 1.25.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3819 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final...

Investigation of STEEP for Secure Communications over SIMO and MISO Channels Subject to Full-Duplex Jamming and Eavesdropping

Secure communications over SIMO and MISO channels between wireless nodes are commonly encountered in applications and widely considered in the literature. This paper investigates such a problem by considering a newly proposed scheme called secrecy-message transmission by echoing encrypted probes...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...