Malicious code in checkout-commit-pos-order-am (npm)

Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific asset path and downloads an opaque native binary over HTTPS...

Malicious code in chandan-module-test (npm)

Source: amazon-inspector a9b92ee71a8547073a6d21685e6190b1769e93db8cbf2be1a57e7e14e8d0d075 The package chandan-module-test was found to contain malicious code. Source: ossf-package-analysis d24d4b24996527538f2d510dbb22bb5dfd49090984bd0da33661aac7e613bfab The OpenSSF Package Analysis project...

Malicious code in chalk-stop-indus-module (npm)

Source: amazon-inspector 87bb8e1129a1d5a199fd42030542e91c8c409a534084d9519532cc4057e92cc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in centaurus-quasar-module-rimraf (npm)

Source: amazon-inspector a29e050252b3c774ca548dd99315e0f8c4a20a46b58ff9253a699a09e756ea1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in centauri-module-adonis-reveal-md (npm)

Source: amazon-inspector a700eed4fe580bb90a2d48dde70b037670425faae5851b9fb6a622d25c819e6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

MAL-2026-15924 Malicious code in real-router-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450 Package ships telemetry.js, an obfuscated module string-array accessor pattern hiding identifiers and the destination that reads host identity...

CVE-2025-71408

A flaw was found in NLTK Natural Language Toolkit. This eval injection vulnerability in the nltk.collocations module allows a local attacker to execute arbitrary Python code. By manipulating command-line arguments when collocations.py is invoked directly, an attacker can bypass validation and...

kernel: smc: Fix use-after-free in __pnet_find_base_ndev()

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in pnetfindbasendev. syzbot reported use-after-free of netdevice in pnetfindbasendev, which was called during connect. 0 smcpnetfindismresource fetches skdstgetsk-dev and passes down to pnetfindbasendev,...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

kernel security update

6.12.0-211.51.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the ccpaescomplete function in the drivers/crypto/ccp/ccp-crypto-aes.c module of the Linux kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-85520

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. check dns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the tcfctflowtableget function within net/sched/actct.c, a part of the net/sched traffic control subsystem in the Linux kernel, is related to improper memory usage after deallocation. Exploitation of this vulnerability could allow an attacker to compromise the confidentiality...

bpf DoS

The vulnerability of the btfcheckdtorkfuncs function in the kernel/bpf/btf.c module, which supports the BPF interpreter for Linux kernels, is related to improper security checks for standard elements. Exploiting this vulnerability could allow an attacker to cause service failures...

fastrpc_get_args() function Heap Buffer Overflow DoS

The vulnerability in the fastrpcgetargs function within the drivers/misc/fastrpc.c module of the Linux kernel is related to a potential integer overflow. Exploitation of this vulnerability could allow an attacker to compromise the confidentiality, integrity, and availability of protected...

Linux kernel zram_bvec_write_partial Heap Buffer Overflow

The vulnerability of the zrambvecwritepartial function in the drivers/block/zram/zramdrv.c module of the Linux kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux kernel IVPU IPC Buffer Overflow DoS

The vulnerability in the ivpuipcreceive function within the drivers/accel/ivpu/ivpuipc.c file of the Linux kernel system is related to integer overflow or cyclic shift. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of...

netfilter Heap Buffer Overflow DoS

The vulnerability in the nftexthdrinit function within net/netfilter/nftexthdr.c of the Linux kernel’s netfilter component involves access to an uninitialized pointer. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of...

Linux kernel Networking Function Heap Buffer Overflow DoS

The vulnerability of the inputprocesspayload function in the net/xfrm/xfrmiptfs.c module, which is part of the networking functions in the Linux kernel, is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow a remote attacker to...