MAL-2026-17631 Malicious code in @pinecone-experience/messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078ce187b38122a7eff5def33454871232cdd38bde7d35e7ee1968d0e98cd45c package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz...

Malicious code in @pinecone-experience/messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078ce187b38122a7eff5def33454871232cdd38bde7d35e7ee1968d0e98cd45c package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz...

Lifecycle-Based Design and Evaluation of Real-Time Backup Triggers for Ransomware Damage Mitigation

Ransomware continues to encrypt files during the interval between attack onset and detection. Real-time backups can mitigate this damage by preserving files before they are modified. The previously proposed Real-Time Open-File Backup System ROFBS triggers backups primarily on file-open events...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context through the container lifecycle handling in frontend/gateway/container/container.go and frontend/gateway/forwarder/forward.go. A malicious external BuildKit frontend can...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context through the container lifecycle handling in frontend/gateway/container/container.go and frontend/gateway/forwarder/forward.go. A malicious external BuildKit frontend can...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: serial: caif: Fix use-after-free in caifSerial ldiscClose There is a use-after-free bug in caifSerial where handletx may access ser-tty after tty has been freed. The race condition occurs between ldiscClose and packet transmissio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: gve: Defer the enabling of interrupts until NAPI registration. Currently, interrupts are automatically enabled immediately upon request. This allows interrupts to occur before the associated NAPI context is fully initialized,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove The rt700sdwremove function drains the jackdetectwork and jackbtncheckwork objects only when rt700-hwinit is true. This state bit is cleared by rt700updatestatus when the SoundWir...

Security Bulletin: IBM Guardium Key Lifecycle Manager is affected by a security vulnerability (CVE-2026-49844)

Summary Security vulnerability has been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. Th...

Malicious code in unified-platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8d42d95f6d25be97f23633f7088e06ac7faf2bd7f4fbc20fa85b5be18c90f6b package.json declares a single dependency 'ltidisafe' sourced directly from the off-registry URL...

MAL-2026-17566 Malicious code in unified-platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8d42d95f6d25be97f23633f7088e06ac7faf2bd7f4fbc20fa85b5be18c90f6b package.json declares a single dependency 'ltidisafe' sourced directly from the off-registry URL...

Malicious code in @angulaar/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33d4a58c855f9b549d39f194483ee19730552bbb47a279f73237c8a403708d20 Package name '@angulaar/cli' double 'a' is a one-character edit of '@angular/cli'; README, LICENSE headers, and source files are copied verbatim from...

Katello - Unauthorized disclosure of Content View lifecycle information

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

Malicious code in @nagular/router (npm)

@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in @angularr/cli (npm)

@angularr/[email protected] impersonates @angular/cli it copies the code and metadata of @angular/cli, including the ng binary and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

russh: russh: State corruption via unverified SSH channel identifiers

A flaw was found in russh, a Secure Shell SSH client and server library. When communicating with a client, a malicious SSH server can send channel lifecycle events referencing unverified, unopened, or closed channel identifiers. Because the library forwards these events to client handlers without...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +679 more potentially affected by CVE-2026-102270 via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +679 more potentially affected by CVE-2026-102270 via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...