Malicious code in @onereach/slack-helpers (npm)

npm/@onereach/slack-helpers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11521 Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

dssrf has an SSRF bypass with remove_at_symbol_in_string

Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, isurlsafe does: ts u ...

CVE-2026-64528

A flaw was found in the Linux kernel's Samsung serial driver. When console flow control is enabled, a redundant attempt to acquire a port lock occurs within the receive helper functions. This can lead to a deadlock on the same CPU, causing the system to become unresponsive...

GHSA-R5JH-Q2MW-GCX4 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...

Malicious code in @thone33/react-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 656fe3d401e0d4fed0ad443f49971c4e173132d173cc7eb443a1ccca731bc5cf Package @thone33/[email protected] was scanned and no a static rule matches or behavioral findings were produced. No evidence of credential access,...

MAL-2026-11078 Malicious code in @thone33/react-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 656fe3d401e0d4fed0ad443f49971c4e173132d173cc7eb443a1ccca731bc5cf Package @thone33/[email protected] was scanned and no a static rule matches or behavioral findings were produced. No evidence of credential access,...

CVE-2026-64528

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

CVE-2026-64528 tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

EUVD-2026-49040

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

CVE-2026-64528

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

PT-2026-63319

Name of the Vulnerable Software and Affected Versions accountsservice versions prior to 23.13.9-8ubuntu7 Description Ubuntu-specific language helper scripts, specifically save-to-pam-env and update-langlist, fail to properly sanitize the LANGUAGE entry within the /.pam environment file. This inpu...

@0xbigboss/starlight-llms-txt (>=0.8.0-beta.1, <=0.8.0-beta.2), @1771technologies/lytenyte-doc (1.0.13) +747 more potentially affected by CVE-2026-59730 via @astrojs/internal-helpers (>=0.3.0, <=0.10.0)

@astrojs/internal-helpers NPM version =0.3.0, =0.8.0-beta.1, =0.0.1, =1.0.0, =0.0.3, =0.2.0, =1.1.0, =1.0.0, =0.4.2, =0.9.0, =0.1.6, =1.0.1, =1.0.3 and more Source cves: CVE-2026-59730 Source advisory: SNYK:JS-ASTROJSINTERNALHELPERS-18085626...

Open Redirect

Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Open Redirect via the static file handler when the trailingSlash: 'always' configuration is enabled. An attacker can redirect users to unintended external sit...

ROOT-APP-NPM-CVE-2025-27789 CVE-2025-27789 in @rootio/babel__helpers - Patched by Root

Root has patched CVE-2025-27789 in the @rootio/babelhelpers package for Root:npm. Multiple fixed versions available...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

Linux Distros Unpatched Vulnerability : CVE-2026-63839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint...

CVE-2026-63839

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint leaks output.pointer when retval == NULL found by sashiko.dev 1. Fix it by moving retobj = output.pointer' outside of the if retval' block...

CVE-2026-63839 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint leaks output.pointer when retval == NULL found by sashiko.dev 1. Fix it by moving retobj = output.pointer' outside of the if retval' block...