MAL-2026-10946 Malicious code in @akrai/core (npm)

The @akrai/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

PT-2026-61599

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

MAL-2026-10945 Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

MAL-2026-10932 Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10781 Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

PT-2026-61313

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethtool CMIS component where the kernel does not properly validate the length of the Common Management Interface Specification CMIS Capability Data Block CDB reply...

CVE-2026-12228

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

MAL-2026-10917 Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports telemetryinit, causing every...

Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports telemetryinit, causing every...

Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, whi...

MAL-2026-10916 Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, whi...

Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

MAL-2026-10779 Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Code Injection

@prompty/core is vulnerable to Code Injection. The vulnerability is due to the use of gray-matter with executable JavaScript frontmatter enabled, which allows an attacker to execute arbitrary JavaScript by supplying a malicious .prompty file...

SUSE SLES15 Security Update : joe (SUSE-SU-2026:3108-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3108-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Tenable has extracted t...