PT-2026-89119

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description An integer overflow occurs in the unc decoder::get compressed image data uncompressed function within the no-icef full-item branch. This happens when a crafted uncompressed tile grid provides ...

openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21711-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21711-1 advisory. Security issues fixed: - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflow in the...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

GO-2026-6312 KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela

KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela...

ROOT-APP-NPM-CVE-2022-37599 CVE-2022-37599 in loader-utils - Patched by Root

Root has patched CVE-2022-37599 in the loader-utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-37601 CVE-2022-37601 in loader-utils - Patched by Root

Root has patched CVE-2022-37601 in the loader-utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-37603 CVE-2022-37603 in loader-utils - Patched by Root

Root has patched CVE-2022-37603 in the loader-utils package for Root:npm. Multiple fixed versions available...

@forgeax/game (>=0.3.0, <=0.3.10), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +9 more potentially affected by CVE-2026-82393 via pnpm (>=11.5.3, <=11.7.0)

pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

SUSE CVE-2026-74364

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with exclproghash is bound to a single program by hash: checkmapprogcompatibility refuses to load any program whose digest does not match...

Malicious Package

Overview bellatrix-rest-blitz-style-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview bellatrix-protractor-fomalhaut-css-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

SUSE CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

Security update for emacs (important)

openSUSE security update: security update for emacs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21711-1 Rating: important References: bsc1271643 bsc1275927 bsc1275941 bsc1276264 Cross-References: CVE-2026-77219 CVE-2026-79992 CVSS scores:...

EUVD-2026-69289

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...