CVE-2026-19027

A flaw was found in HDF5, a widely used data management library. This vulnerability allows an attacker to craft a malicious HDF5 file that, when processed, can cause the application to read beyond its allocated memory. This out-of-bounds read could lead to the disclosure of sensitive information ...

CVE-2026-19028

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file with a specially designed Fletcher32-filtered chunk. When this file is processed, an integer underflow occurs due to insufficient size validation, leading to a massive out-of-bounds read. This vulnerability can cause the...

CVE-2026-19025

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service DoS and...

Malicious code in external-process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...

Malicious code in vexium-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...

MAL-2026-13961 Malicious code in velora-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...

MAL-2026-13951 Malicious code in functions-framework-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...

MAL-2026-13960 Malicious code in process-live-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a36d35f64443b9dc4a2395017b8738562a321c9765089f916eeebdf58281d57 The default export getPlugin issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 and passes the returned...

CVE-2026-24059

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

Malicious code in npm-hex-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to...

Malicious code in js-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe The npm package js-assert-plus masquerades as an assertion library homepage http://js-assert-plus.com and bundles the real chai source so consumers g...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process termination...

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...

MAL-2026-14001 Malicious code in finvu-hdfc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d8b7aaf87c416d1ac2144be116de9085318fa6991c455346596ddc26a676f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14014 Malicious code in try-lock-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 941a65c056bbb40a20dd7b1f4107bf804df157df12ea0b89067fc6770afe3b6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14006 Malicious code in priority-mutex-lane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd0cb794e1b53c6b4c63bdd456196771029c0c003a33694581dadd3707acf0e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...