233054 matches found
CVE-2026-74574
A flaw was found in the Linux kernel's dmaengine IDXD subsystem. A race condition during file-device setup failure cleanup in the idxdcdevopen function could lead to a deadlock, causing a denial of service. Furthermore, incorrect cleanup paths could result in operations on a freed memory context,...
badkeys v0.0.20
badkeys Tool and library to check cryptographic public keys for known vulnerabilities what? badkeys checks public keys in various formats for known vulnerabilities. A web version can be found at badkeys.info. install badkeys can be installed via pip: root@kitploit: pip3 install badkeys You may wa...
The invisible passenger in your car
While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app mig...
CVE-2026-74510
A flaw was found in the Linux kernel's Bluetooth management mgmt component. A race condition exists during the cancellation of a pairing command and the handling of pairing completion or authentication failure callbacks. This race condition can lead to a use-after-free vulnerability, which may...
Security update for podman
This update for podman rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
Security update for containerd
This update for containerd rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux...
Security update for docker
This update for docker rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
Security update for cosign
This update for cosign rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
Malicious code in mcq-session (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...
MAL-2026-14347 Malicious code in mcq-session (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...
Malicious code in moidevy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...
MAL-2026-14348 Malicious code in moidevy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...
MAL-2026-14345 Malicious code in express-session-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...
Malicious code in express-session-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...
MAL-2026-14344 Malicious code in @js-lib-team/env-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...
Malicious code in @js-lib-team/env-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...
Malicious code in chai-as-soul (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...
MAL-2026-14343 Malicious code in chai-as-soul (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...
Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)
Summary DS8900F and DS8A00 updates have been released to remediate vulnerabilities in various components like IBM Java Quarterly Update, IBM WebSphere Application Server, IBM Power HMC, Linux Kernel, OpenSSL, libsoup, libssh, OpenSSH, net-snmp, Apache HTTP Server httpd, Expat libexpat, libpng,...
SUSE CVE-2026-68278
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...