MAL-2026-11129 Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

MAL-2026-11136 Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62423

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-62424

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

UBUNTU-CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-42494

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-42495

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-42494

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-46428

A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...

CVE-2026-13916

An inappropriate implementation flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=508283108...

CVE-2026-62434

The Xen hypervisor is vulnerable to a memory management flaw when Populated on Demand (PoD) is enabled. A guest can attempt to reclaim pages that are not regular guest RAM, potentially leading to corruption of the memory management state . Remediation is available via specific distribution update...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62434 PoD: Don't try to reclaim special pages

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...

CVE-2026-62434 PoD: Don't try to reclaim special pages

A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen...