PT-2026-58464

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A use-after-free condition occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue where an...

CVE-2026-58540: Improper Authorization

Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-50490: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-48572: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-48571: Use After Free

Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-50400: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows App Installer allows an authorized attacker to elevate privileges locally...

Malicious code in bubblestring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d88c674968228c1d12eff609caca870ebe6d572631e15e2bdde0d0d4b7a320f9 package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js is heavily obfuscated...

Malicious code in @quukk/opencode-clawmessenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticate...

MAL-2026-10495 Malicious code in @quukk/opencode-clawmessenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticate...

Malicious code in cktool-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ee2228fd4f97fcc261019bf662b6e3006a5aed7a6f3bc0ec4fa505a84aa037 cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolver misroutes the scoped nam...

MAL-2026-10457 Malicious code in cktool-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ee2228fd4f97fcc261019bf662b6e3006a5aed7a6f3bc0ec4fa505a84aa037 cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolver misroutes the scoped nam...

Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

qt-installer (0.1.0), sotoki (>=2.0.0, <=2.0.2) +3 more potentially affected by CVE-2026-55206 via py7zr (0.16.4)

py7zr PYPI version 0.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qt-installer 0.1.0 - sotoki =2.0.0, =1.0.0, =0.5.2, =0.1.0, =2021.7.29 Source cves: CVE-2026-55206 Source advisory: OSV:PYSEC-2026-2973...

qt-installer (0.1.0), sotoki (>=2.0.0, <=2.0.2) +3 more potentially affected by CVE-2026-55195 via py7zr (0.16.4)

py7zr PYPI version 0.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qt-installer 0.1.0 - sotoki =2.0.0, =1.0.0, =0.5.2, =0.1.0, =2021.7.29 Source cves: CVE-2026-55195 Source advisory: OSV:PYSEC-2026-2972...

qt-installer (0.1.0), sotoki (>=2.0.0, <=2.0.2) +3 more potentially affected by CVE-2026-23879 via py7zr (0.16.4)

py7zr PYPI version 0.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qt-installer 0.1.0 - sotoki =2.0.0, =1.0.0, =0.5.2, =0.1.0, =2021.7.29 Source cves: CVE-2026-23879 Source advisory: OSV:PYSEC-2026-2974...

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

PYSEC-2026-2876 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

MAL-2026-10418 Malicious code in note-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f093c8536c89f9d6c524ae212051fc45a5244d910afd8ee3abe30698f15b75d The package masquerades as a pino-style logger keywords fast/logger/stream/json; lib/ contents copied from pinojs/pino but ships an additional loader...

MAL-2026-10319 Malicious code in ishowfeet17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a7da1cae4bcc5f4805bed7bd781b9e27de67b2264f6ba7740c8730369c9405 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...