Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11422 Malicious code in asdk-plugin-alphagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11423 Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11195 Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

DotNetNuke 07.04.00 - Administration Authentication Bypass

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. id: CVE-2015-2794 info: name: DotNetNuke 07.04.00 - Administration Authentication Bypass author: 0xr2r severity...

CVE-2026-17976

Google Chrome (

CVE-2026-17755

CVE-2026-17755 originates from Google Chrome’s Extensions UI handling, described as an incorrect security UI vulnerability in Extensions. The CVE applies to Chrome/Chromium-based browsers and could allow an attacker, if a user is enticed to install a crafted malicious extension, to perform UI spo...

CVE-2026-17739

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-13346 pip absolute path traversal during download from malicious package indexes

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

GHSA-9XQ3-3FQG-4VG7 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Repository: termux/proot-distro Component: prootdistro/commands/install.py → extractplaintar; also helpers/docker.py → applylayer --- Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 confirmed vulnerable | | Termux app |...

CVE-2026-54574

CVE-2026-54574 affects proot-distro prior to 5.1.5. The flaw resides in extraction paths: _extract_plain_tar() (proot_distro/commands/install.py) and _apply_layer() (proot_distro/helpers/docker.py) do not validate symlink targets (member.linkname). A tar archive can plant an absolute host-path sy...

CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

PT-2026-65874

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

MAL-2026-11134 Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

MAL-2026-11145 Malicious code in rollup-runtime-core-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199 The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node repository field points to...

MAL-2026-11129 Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...

SUSE-SU-2026:22950-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...