EUVD-2026-38915

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc call for capinfo-phys in eficapsulesetupinfo uses sizeofphysaddrt instead of sizeofphysaddrt, which might be causing an undersized allocation. The...

CVE-2026-53047

CVE-2026-53047 concerns the Linux kernel EFI capsule-loader heap allocation due to incorrect sizeof in phys array reallocation, potentially enabling a heap overflow on 32-bit PAEs. Public records in OSV show multiple vendor-specific patches and mitigations (e.g., Root Linux packages for Ubuntu 22...

CVE-2026-53047 efi/capsule-loader: fix incorrect sizeof in phys array reallocation

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc call for capinfo-phys in eficapsulesetupinfo uses sizeofphysaddrt instead of sizeofphysaddrt, which might be causing an undersized allocation. The...

CVE-2026-53047 efi/capsule-loader: fix incorrect sizeof in phys array reallocation

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc call for capinfo-phys in eficapsulesetupinfo uses sizeofphysaddrt instead of sizeofphysaddrt, which might be causing an undersized allocation. The...

MAL-2026-6376 Malicious code in bn-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14057d91b2283926b2b0c1093a66db17c40efbd0ceb21c29b0bdbfa79736da5 Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js README, source, version banner v7.0.1, and repo URL all identify as...

Malicious code in bn-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14057d91b2283926b2b0c1093a66db17c40efbd0ceb21c29b0bdbfa79736da5 Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js README, source, version banner v7.0.1, and repo URL all identify as...

PT-2026-51941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An undersized allocation occurs in the efi capsule setup info function due to the use of sizeofphys addr t instead of sizeofphys addr t during a krealloc call for the cap info-phys...

Malicious code in thidweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80721058923b3e5963a6ee170007b8b4131ae5093481456ca10e63f52963987d Package is published as thidweb but its README, source comments, repo URL, and author metadata all identify it as big.js v7.0.1 by Mike McLaughlin...

MAL-2026-6343 Malicious code in thidweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80721058923b3e5963a6ee170007b8b4131ae5093481456ca10e63f52963987d Package is published as thidweb but its README, source comments, repo URL, and author metadata all identify it as big.js v7.0.1 by Mike McLaughlin...

Malicious code in rainbownkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970be1fb6306ff1e8dc6119d96404f600a1eb44a47124e2910bb9237bb80fe9a Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README, repository URL, and autho...

MAL-2026-6340 Malicious code in rainbownkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970be1fb6306ff1e8dc6119d96404f600a1eb44a47124e2910bb9237bb80fe9a Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README, repository URL, and autho...

MAL-2026-6344 Malicious code in thirdwebjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3 Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader...

Malicious code in thirdwebjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3 Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader...

Malicious code in rainbokit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692bd458c1417d7b87761cfa62e666685cb8d2ebf605b54de3ef8ad5dd993555 The package publishes as rainbokit but ships a verbatim copy of the legitimate big.js library matching author, repository URL, README, LICENCE, and...

MAL-2026-6339 Malicious code in rainbokit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692bd458c1417d7b87761cfa62e666685cb8d2ebf605b54de3ef8ad5dd993555 The package publishes as rainbokit but ships a verbatim copy of the legitimate big.js library matching author, repository URL, README, LICENCE, and...

CVE-2026-54018 Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validateurl function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only ...

CVE-2026-54018

Open WebUI (self-hosted offline AI) contains SSRF protection bypass in the Playwright Web Loader prior to version 0.9.6. The validator checks only the initial URL; Playwright follows redirects (301/302) by default, allowing an attacker-supplied URL that redirects to internal addresses (e.g., loca...

CVE-2026-54018 Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validateurl function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only ...

Malicious code in ts-grok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a981e7e3ba27d859a2c536cbc25c04ebece92e1992035226ea9246d8bd381f1d Package ts-grok ships a verbatim copy of big.js v7.0.1 same banner, author 'Michael Mclaughlin', repository URL https://github.com/MikeMcl/big.js.git...

Malicious code in ts-escrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9607025df61aa1728bceb1a71534460a9e9edf2f3cd1d4eedd533238786577c2 [email protected] is a verbatim copy of the big.js library README, repository URL, author, version banner, and description all impersonate MikeMcl/big....