ARTful

Description ARTful is a native Android library the allows developers to modify the Android Runtime ART on Android 13 + 14. With this tool, you can dynamically change the implementation of any static method within your application or the Android Framework to affect methods called from within your...

EUVD-2026-93868

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

CVE-2026-106451

A flaw was found in lz4-java. When extracting native libraries, the application writes temporary files to a shared directory using predictable file paths without exclusive file creation controls. A local attacker with access to the shared directory could exploit this race condition to replace the...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation...

UBUNTU-CVE-2026-8798

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...

MAL-2026-13422 Malicious code in beautiful-ui-monitoring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101 [email protected] advertises itself as a UI package description 'creates a beautiful ui design', keywords c/gcc/native but ships no UI...

Malicious code in beautiful-ui-monitoring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101 [email protected] advertises itself as a UI package description 'creates a beautiful ui design', keywords c/gcc/native but ships no UI...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

CVE-2026-13165: Unrestricted Upload of File with Dangerous Type

SzafirHost verifies the downloaded native library archive with one JarFile parser reading the Central Directory but extracts native libraries with JarInputStream parser reading sequentially from local file headers. An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as...

BIT-TOMCAT-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: fr...

CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat...

CVE-2022-38216

An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds...

EUVD-2025-23669

Malicious code in bioql PyPI...

Malicious code in react-native-lib-teste (npm)

The package react-native-lib-teste was found to contain malicious code...

MAL-2025-31817 Malicious code in react-native-lib-teste (npm)

The package react-native-lib-teste was found to contain malicious code...

CVE-2025-54594

react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pullrequesttarget event trigger, which allowed for untrusted code from a forked pull request to...

CVE-2025-5099

An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution...

Mobile Dynamix PrinterShare Mobile Print 安全漏洞

Foxit PDF Reader is a software for reading and working with PDF documents. A memory corruption vulnerability exists in Foxit PDF Reader. The vulnerability stems from an out-of-bounds write to the native library when attempting PDF rendering, resulting in memory corruption. An attacker can exploit...

BIT-GRADLE-2025-27148 Gradle vulnerable to local privilege escalation through system temporary directory

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be...