Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dims-svelte-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bad5399590f49863bf42eff11c2a4c9f22c7db3dbc91d710faa0dfc732f02a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14405 Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Astra Linux – Vulnerability in Qemu

A vulnerability related to out-of-bounds read/write access was discovered in the USB emulator of QEMU in versions prior to 5.2.0. This issue occurs during the processing of USB packets from a guest, when the value of USBDevice’s ‘setuplen’ exceeds the value of ‘databuf4096’ in the dotokenin and...

CVE-2026-74516

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is...

GHSA-CXGV-HP74-JJ7R Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622

The CVE concerns KubeVirt, specifically virt-handler’s migration proxy. During live migration, the proxy dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths without symlink protection. Socket paths live in qemu-owned directories writable by the virt-launcher user. An att...

EUVD-2026-57266

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-72885 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2026-72877

Dokploy (PaaS) contains a command-injection vulnerability in buildRemoteDocker(): the dockerImage field was interpolated into shell commands without quoting, allowing an authenticated user with application create/update permissions to perform shell command substitution and execute arbitrary comma...

Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...

MAL-2026-13390 Malicious code in @xsat10/baileys-xsat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37ba86faab85b50d9ae903ee59c78a8b52e46797b4c003448cd9851cd774939b Package is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence patterns matched on lib/Utils/generics.js ping/GET references and...

MAL-2026-12016 Malicious code in @keyv/memcache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 738202807ef51e0d987243e641bb2e97a2f4535bed388d631d80ead963a82b2f Package @keyv/[email protected] is a Keyv storage adapter for Memcache. No install-time lifecycle scripts, network exfiltration, credential access,...

Malicious code in internallib_v568 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755dfc0e12b6602ff21d04446f2c6bdc23499c0bd9645c14b9209dc25fbb0be5 [email protected] is shaped as a dependency-confusion artifact against a private package name. The main module exports a payload containing a...

MAL-2026-11491 Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db27d7cbc4d04670f5b2d1e199294b46fd92375598b362f501010c0cc1eddf9 The package's postinstall hook invokes lib/report.js, which harvests the developer's email queried via gh api user/emails, git config, npm config, an...

Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...