255606 matches found
Exploit for Improper Authorization in Microsoft
Certighost Slidev deck This directory contains the Slidev pre...
Malicious code in @ks-radar/radar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...
GHSA-R292-9MHP-454M vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, renovate, kubeflow-centraldashboard, haraka, node-gyp, opensearch-dashboards, prism, code-server, gitlab-rails-ce, actions-runner, graalvm, gemini-cli, sqlpad, pulumi, kibana, lerna, npm...
GHSA-R292-9MHP-454M vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, kubeflow-centraldashboard, prism, lerna, npm, node-gyp, pulumi, code-server, sqlpad, renovate...
SUSE CVE-2026-64301
In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...
MAL-2026-11065 Malicious code in swiper_angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...
Malicious code in whs4_deu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute filename path which...
MAL-2026-11072 Malicious code in wsh4_edu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...
SUSE CVE-2026-64413
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...
SUSE CVE-2026-64466
In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...
MAL-2026-11071 Malicious code in whs4_eud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...
Malicious Package
Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...
Malicious Package
Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...
Malicious code in page-navigation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...
Open Redirect
@astrojs/node is vulnerable to Open Redirect. The vulnerability is due to improper validation of request paths beginning with /\ when trailingSlash: 'always' is enabled, which allows an attacker to craft a URL that redirects users to an external malicious site...
CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...
CVE-2026-64477
In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...
CVE-2026-64301
In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...
UBUNTU-CVE-2026-64466
In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...