MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

MAL-2026-11522 Malicious code in beaver-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...

resterm v0.51.1

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-s...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

Malicious code in @qlik/react-native-simple-grid (npm)

npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11976 Malicious code in native-frontend-orb (npm)

npm/native-frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)

npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

PT-2026-74695

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

PT-2026-69029

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1 Description A heap out-of-bounds write and memory corruption occur when processing a zbuffer-only tiled iff file. This...

PT-2026-69031

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1 Description A heap out-of-bounds write and memory corruption can occur when processing a tiled openexr image where the...

PT-2026-74697

TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

PT-2026-74696

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

PT-2026-74682

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

PT-2026-69030

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1 Description An issue exists when processing indexed PSD files with transparency metadata. When oiio:rawcolor or psd:rawda...

PT-2026-69036

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.1.16.0 Description A use-after-scope crash and denial of service can occur when processing a crafted ZIP-compressed TIFF file with TIFF multithreading enabled. The issue arises in the TIFFInput::read native...