30618 matches found
PYSEC-2026-3376 Out of bounds segmentation fault due to unequal op inputs in Tensorflow
Impact tf.rawops.DynamicStitch specifies input sizes when it is registered. cpp REGISTEROP"DynamicStitch" .Input"indices: N int32" .Input"data: N T" .Output"merged: T" .Attr"N : int = 1" .Attr"T : type" .SetShapeFnDynamicStitchShapeFunction; When it receives a differing number of inputs, such as...
MAL-2026-10435 Malicious code in fetchcraft (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...
Arbitrary Command Execution
GitHub CLI is vulnerable to Arbitrary Command Execution. The vulnerability is due to insufficient validation of JupyterLab URLs returned by a Codespace, where attacker-controlled non-loopback URLs such as vscode:// are passed to VS Code, allowing malicious Codespaces to execute arbitrary commands...
Malicious code in kuaishou (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd1d5daf09cc7bfff164e60bf5abd0a1b374b5bb616f0a78cac8f6c6ea613608 The package's prepare lifecycle script, which runs automatically on npm install, collects host, user, and platform identifiers along with the full...
MAL-2026-10416 Malicious code in kuaishou (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd1d5daf09cc7bfff164e60bf5abd0a1b374b5bb616f0a78cac8f6c6ea613608 The package's prepare lifecycle script, which runs automatically on npm install, collects host, user, and platform identifiers along with the full...
MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...
PT-2026-57920
Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.11.0 Description The GitHub Gist export flow fails to properly validate the OAuth2 state value, checking only for its presence instead of verifying it against the user session. This allows an attacker to forge a...
MAL-2026-10215 Malicious code in fast-dotenv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...
Malicious code in auto-debug-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...
MAL-2026-10209 Malicious code in auto-debug-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...
GHSA-FJ8F-M44G-C479
creationtimestamp| type| source ---|---|--- 2026-07-11 17:11:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqf5tmpidk2j...
GHSA-GCM7-57GF-953C
creationtimestamp| type| source ---|---|--- 2026-07-11 04:41:43+00:00| seen| https://gist.github.com/alon710/5b22d6c437eabc82b89ba6fa8ccee27d...
CVE-2026-54063
creationtimestamp| type| source ---|---|--- 2026-07-10 20:35:19+00:00| published-proof-of-concept| https://github.com/qax-os/excelize/security/advisories/GHSA-h69g-9hx6-f3v4 2026-07-10 23:37:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdcwqstcx2s 2026-07-11 00:55:06+00:0...
CVE-2026-54088
creationtimestamp| type| source ---|---|--- 2026-07-10 20:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcxokhktk2v 2026-07-10 20:35:07+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm 2026-07-11...
GHSA-W7CG-WHH7-XP28
creationtimestamp| type| source ---|---|--- 2026-07-10 19:42:40+00:00| seen| https://gist.github.com/alon710/b90f7da9d543dd51155aefe8a87d6f66...
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected] , came embedded wi...
GHSA-VQ3G-6QWH-5WJ2 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu-melange, linux-qemu, linux-azure...
GHSA-CX83-HXFR-M85V vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu-melange, linux-qemu, linux-azure...
