CVE-2026-57012

CVE-2026-57012 affects the Setup Wizard component on Android Pixel devices, as indicated by the reference to the September 2026 Pixel security bulletin. The root cause is a missing permission check that allows a remote package install, enabling remote escalation of privilege without requiring any...

CVE-2026-41651-Python

Pack2TheRoot: CVE-2026-41651 Python PackageKit TOCTOU ローカル特権昇格エクスプロイトの Python PoC。 ローカルの非特権ユーザーは、認証なしで任意のパッケージを root としてインストールできます。 フィールド| 値 ---|--- CVE| CVE-2026-41651 コンポーネント| PackageKit デーモン packagekitd 影響を受けるバージョン| 1.0.2 – 1.3.4 修正バージョン| 1.3.5 影響| ローカル特権昇格 → root 免責事項...

CVE-2025-69604

CVE-2025-69604 説明 この脆弱性は、CVE-2025-61229で説明されているものと類似しています。攻撃者はタスクテンプレートを編集して、SuperDuperのバックアップタスクに任意のパッケージをインストールさせることができます。その後、パッケージはルートユーザーとして、最高レベルのプライバシーアクセス（フルディスクアクセス）でシェルスクリプトを実行できます。 参考文献 SuperDuper Security Update v3.12 CVE-2025-69604 CVSS 3.1 スコア: NVD スコアは保留中です。 緩和策...

CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

Linux Distros Unpatched Vulnerability : CVE-2026-73416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6....

MAL-2026-13549 Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

GHSA-GJFG-22FP-RRXX Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...

Malicious code in fetchcraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...

MAL-2026-10419 Malicious code in notifications-broadcast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2 [email protected] ships an empty index.js module.exports = ; with placeholder metadata empty description, empty author, version 99.9.1...

MAL-2026-6585 Malicious code in stake-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a475d161b669ae748124a4d6c1da29ebda6e40da4aa5c3c5e8b10645ef96f57a On npm install, the package's postinstall hook scripts/install-check.cjs, wired via package.json scripts.postinstall fetches a JSON config from a...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-59195 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59195 Source advisory: OSV:GHSA-QRV3-253H-G69C...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-50021 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-50021 Source advisory: OSV:GHSA-Q6J5-FJX5-2MC3...

GHSA-Q6J5-FJX5-2MC3 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

Summary pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install...

MAL-2026-6482 Malicious code in kelly-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...

MAL-2026-6238 Malicious code in atlasora-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5 package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https, fs, os, and childprocess;...

Malicious code in metrics-pipeline-d8k2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01ad2ee3d3807102a3f02c01af0d3fec46d91e9764eb77a8bcedf9c6be7fc3b0 Package declares "postinstall": "node run.js" in package.json, causing automatic execution of bundled beacon scripts on npm install. beacon29.js load...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53571 Source advisory: OSV:GHSA-FX2H-PF6J-XCFF...

MAL-2026-5562 Malicious code in @koadz/sso (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d284d5d0421ad906d63959ed4e0f3354106166311f4066ff794669f52d1eacfb package.json declares a postinstall hook that runs dist/index.js. The compiled bundle contains an appended payload absent from the index.ts source...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...