8377 matches found
MAL-2026-13360 Malicious code in uzair-rajput-new (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...
CVE-2026-70608
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...
CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...
CVE-2026-70607 Electron: window.open features string controls some window options considered privileged
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...
Malicious code in crypto-checkout-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...
Malicious code in chai-as-rendered (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...
MAL-2026-12473 Malicious code in table-ui-new (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...
new-native-tools (>=3.1.42-as2-9980-418-1785845663, <=3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-1785842977) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.42)
new-native-tools-linux-x64-gnu NPM version 3.1.42 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.42-as2-9980-418-1785845663,...
new-native-tools (>=3.1.43-as2-9980-421-1785848450, <=3.1.43) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.43)
new-native-tools-linux-x64-gnu NPM version 3.1.43 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.43-as2-9980-421-1785848450, =3.1.43 Source cves: unknown CVE Source advisory:...
UBUNTU-CVE-2026-64574
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...
Important: python3.12
Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...
CVE-2026-18092
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...
CVE-2026-18092
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...
EUVD-2026-52229
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed...
USN-8620-3 linux-intel-iot-realtime, linux-intel-iotg-5.15 vulnerabilities
Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...
Important: Red Hat Security Advisory: RHACS 4.11.2 security and bug fix update
Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...
SUSE CVE-2026-52807
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
SUSE CVE-2026-64557
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2capsocknewconnectioncb l2capsocknewconnectioncb returned l2cappisk-chan after releasesockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable via the...
Metasploit Framework 6.5 Released
Today we’re proud to announce that Metasploit Framework version 6.5 has been released. Over the past two years, with the help of countless contributors, we’ve added 422 new modules along with a whole slew of new features. Malleable C2 Profiles for HTTP One of the latest and most requested feature...
Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...