101 matches found
BIT-KEYCLOAK-2025-12150 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...
Malicious code in depcruise-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...
MAL-2026-14054 Malicious code in depcruise-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...
Malicious code in fmt-util-k7x2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...
MAL-2026-13950 Malicious code in fmt-util-k7x2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...
Malicious code in date-fmt-helper-xz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b384650ec0fabdd01a7dfc513cccd25156611a04c17ba0c435b950ddb9215777 date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host...
Malicious code in date-fmt-utils-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...
Malicious code in @daylightqc/date-fmt-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...
Malicious code in fmt-date-lite (npm)
The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...
MAL-2026-10115 Malicious code in fmt-date-lite (npm)
The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: media: iris: fixed the use-of-free of fmtsrc during the MBPF check. During concurrency testing, multiple instances can run in parallel. Each instance uses its own inst-lock, while the core-lock protects the list of active...
MAL-2026-6092 Malicious code in fmt-helpers-794b (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19b05306978ff506805f118049f81c74c5da1503bb34fd14a2a57d4e6faac52c Package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that runs run.js automatically on npm install. run.js...
OSV-2026-886 Heap-buffer-overflow in ihevcd_fmt_conv
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520748344 Crash type: Heap-buffer-overflow WRITE 8 Crash state: ihevcdfmtconv ihevcddecode Codec::decodeFrame...
SUSE CVE-2026-46210
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmtsrc during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst-lock while the core-lock protects the list of active instances. T...
CVE-2026-46210 media: iris: fix use-after-free of fmt_src during MBPF check
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmtsrc during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst-lock while the core-lock protects the list of active instances. T...
PT-2026-44333
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1 Description A use-after-free issue exists in the iris media driver. A race condition occurs because the inst-lock protects individual instance internals while the core-lock protects the active instance...
OSV-2026-805 Heap-buffer-overflow in ihevcd_fmt_conv
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515832483 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdfmtconv ihevcddecode ihevcdcxaapifunction...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Fixed a null-point-dereference issue in fmtsinglename. Check the return value of devmkstrdup in case of null-point-dereference...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.95.0-5.hum1 aarch64, x8664 clippy-1.95.0-5.hum1 aarch64, x8664 rust-1.95.0-5.hum1 aarch64, x8664 rust-analyzer-1.95.0-5.hum1 aarch64, x8664 rust-debugger-common-1.95.0-5.hum1 noarch...