Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

MAL-2026-14258 Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

Malicious code in mapkit-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86 Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped npx mapkit-loader invocations. The...

MAL-2026-14218 Malicious code in mapkit-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86 Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped npx mapkit-loader invocations. The...

Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

MAL-2026-14199 Malicious code in txs-runner-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254 The package advertises itself as generating random transaction data, but its main API method getTransactions invokes loadtransactiondata, which reads...

MAL-2026-14193 Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...

Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...

CVE-2026-75093

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093

Affected software: Sonos Tract (Rust ML framework) up to v0.23.4. Root cause: Tensor::from_raw_dt_align in data/src/tensor.rs (ONNX Initializer Loader) miscalculates buffer size. Impact: Remote attacker can trigger memory corruption or crash (CVSS 4.3 MEDIUM, availability only). Remediation: Appl...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

EUVD-2026-60565

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-017 (ALASGIMP-2026-017)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-017 advisory. A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by...

dyen macOS In-Memory Mach-O Loader

dyen is a macOS in-memory Mach-O dynamic library loader designed to execute a dylib using the stock Python interpreter without writing the decrypted Mach-O to disk or registering the payload with dyld. It supports encrypted standalone payloads and encrypted dylibs appended to otherwise valid cove...

PT-2026-76902

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from raw dt align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely...

CVE-2026-75093: Incorrect Calculation of Buffer Size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

Linux Distros Unpatched Vulnerability : CVE-2026-74331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmwareloader: Fix recursive lock in devicecachefwimages A recursive locking deadlock can occur in the firmware loader's power management notification handler...