CVE-2026-64102 RDMA/siw: Reject MPA FPDU length underflow before signed receive math

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

CVE-2026-64102

CVE-2026-64102 affects the Linux kernel RDMA/siw path. A malicious siw peer can send an iWARP FPDU whose MPA length (mpa_len) is smaller than the fixed DDP/RDMAP header for the announced opcode, triggering an underflow in fpdu_part_rem during siw_tcp_rx_data and leading to a potential out-of-boun...

JLSEC-2026-709

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions sp256mul9, sp256sqr9, etc., leading to a timing...

MAL-2026-10466 Malicious code in polymarket-math-stake-kelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to...

MAL-2026-10467 Malicious code in polymarket-stake-kelly-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01715ebd11c8adf6ac26ce11bc5fc07e6cfb6775fa77dbe1ca022d0d6593b99c [email protected] ships a postinstall script scripts/install-check.cjs referenced by package.json's postinstall hook that on every np...

PYSEC-2026-3402 verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()

A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function mathequal of the file primemath/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be...

PYSEC-2026-3237 TensorFlow vulnerable to integer overflow in math ops

Impact When RangeSize receives values that do not fit into an int64t, it crashes. cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

PYSEC-2026-3367 TensorFlow vulnerable to integer overflow in math ops

Impact When RangeSize receives values that do not fit into an int64t, it crashes. cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

MAL-2026-10089 Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

MAL-2026-10083 Malicious code in clob-math-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6b75c25c58b35cca1a29500c1608eb1b121e37bd9305ff549d05d73b69031 Package presents itself as a Polymarket CLOB math SDK but is published from a domain not owned by Polymarket polymarket-clob-service.vercel.app; the...

MAL-2026-10068 Malicious code in polymarket-kelly-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b668f5fa9e3cce1dd0ddee31443ff3e797c19e9343b750dee86ddef888b02a The package's postinstall script scripts/install-check.cjs fetches a config JSON from a hardcoded anonymous personal endpoint...

MAL-2026-10070 Malicious code in polymarket-kelly-stake-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9798cce0effcbcf5ed3295f322a375bb1a3cbb7e9db4b7d88c802bf5116639e3 [email protected] advertises itself as a pure Kelly-stake math helper but its postinstall hook scripts/install-check.cjs, invoked fro...

PYSEC-2026-1760 Byaidu PDFMathTranslate vulnerable to open redirect

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...

PYSEC-2026-1461 Indico vulnerable to Cross-Site Scripting via LaTeX math code

Impact There is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds Only let trustworthy users create content on...

PYSEC-2026-1764 pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

PYSEC-2026-1955 TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

Impact NPE in QuantizedMatMulWithBiasAndDequantize with MKL enable python import tensorflow as tf func = tf.rawops.QuantizedMatMulWithBiasAndDequantize para='a': tf.constant138, dtype=tf.quint8, 'b': tf.constant4, dtype=tf.qint8, 'bias': 31.81644630432129, 47.21876525878906, 109.95201110839844,...

MAL-2026-6806 Malicious code in bn-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abaee8f5214f1143815e70bd6c329b82b418cdf6232715eb3b64d32547407a50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-MASTODON-2026-50129 Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by Uncaught Exception vulerability, due to missing exception handling in the math sanitizer. Malformed nodes can result in a DoS of a whole server or targeted...