MAL-2026-11072 Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

SUSE CVE-2026-64413

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

SUSE CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

MAL-2026-11071 Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99958415864bd2ddd266b99c59cdc35841e7efd9eff38481d69f4e740badd958 On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home directory, DNS server list,...

Open Redirect

@astrojs/node is vulnerable to Open Redirect. The vulnerability is due to improper validation of request paths beginning with /\ when trailingSlash: 'always' is enabled, which allows an attacker to craft a URL that redirects users to an external malicious site...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

Race Condition

n8n is vulnerable to Race Condition. The vulnerability is due to a race condition in the Git node's clone operation that allows an authenticated attacker to replace a validated directory with a symlink, plant a malicious repository as a custom node, and achieve arbitrary code execution when the...

CVE-2026-64477

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

UBUNTU-CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

CVE-2026-64301

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

MAL-2026-11063 Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4180bb77cfdee32b5d3547f4edf9c8962fb4bbe6ee595275241cb0871d2371 index.js runs as a preinstall lifecycle script on npm install. It collects host identity and network configuration — os.hostname, os.platform, os.arc...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...

CVE-2026-64477

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

CVE-2026-64466

CVE-2026-64466 affects the Linux kernel where, in the rust_binder component, a freeze listener may linger in the freeze_listeners red-black tree and the remote node’s listener list after the referenced object’s refcount reaches zero. This can create a refcount cycle and potentially a memory leak....