EUVD-2026-40781

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

DEBIAN-CVE-2026-14094

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14094

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14094

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14094

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14094

Summary (CVE-2026-14094) : A use-after-free flaw in the Chrome Windows Installer component allows a local attacker to escalate to OS-level privileges by loading a malicious file. Affected software: Google Chrome on Windows (prior to version 150.0.7871.47). Root cause: use-after-free in the Instal...

MAL-2026-6699 Malicious code in ecto-corsair-flag-7kq3mz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script...

Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

PT-2026-54369

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Installer component on Windows. This flaw allows a local attacker to achieve OS-level privilege escalation by utilizing a malicious file. Use after...

MAL-2026-6582 Malicious code in openai-agents-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files — /.gitconfig and the...

Malicious code in openai-agents-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files — /.gitconfig and the...

Malicious code in stake-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a475d161b669ae748124a4d6c1da29ebda6e40da4aa5c3c5e8b10645ef96f57a On npm install, the package's postinstall hook scripts/install-check.cjs, wired via package.json scripts.postinstall fetches a JSON config from a...

Malicious code in rebrandly-domains-search-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4464320c8530d582d35f85ce95045182d82e1dd63a830644bcb68f05bdf10e Package [email protected] is an empty module index.js exports an empty object whose package.json preinstall hook runs node...

@antfu/nip (0.1.1), @condu-feature/auto-package-exports (>=1.0.0, <=1.0.3) +74 more potentially affected by CVE-2026-59194 via @pnpm/config.deps-installer (>=1000.0.1, <=1000.1.9)

@pnpm/config.deps-installer NPM version =1000.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.2, =26.2.0, =1.0.6, =0.6.19, =0.1.0-beta.0, =0.2.10 - @mirta/rollup 0.3.5 - @platformatic/pnpm-api 0.1.0 - @pnpm/building.build-commands 1000.0.0-0 and more Source cves: CVE-2026-59194 Source advisory:...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +8 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-installer (>=1101.0.0, <=1101.8.0)

@pnpm/installing.deps-installer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSINSTALLER-17660539...

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-2503)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when...

CVE-2026-46710

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the...

CVE-2026-46710 Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the...

CVE-2026-46710

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the...