630156 matches found
Malicious Package
Overview @mikudeveloper/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
PT-2026-98087
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPICA component where the byte count is not properly validated during package length reading within the acpi ps get next package length function. Recommendations ...
PT-2026-104989
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi ns custom package acpi ns custom package unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Typ...
PT-2026-98080
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the ACPICA component. The function acpi ns custom package unconditionally dereferences the first element of a package to read the BIX version number...
RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:71420)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71420 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...
PT-2026-98092
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the intel rapl component of the powercap subsystem. The issue occurs within the rapl add package cpuslocked function when topology physical package id or topology...
PT-2026-104927
In the Linux kernel, the following vulnerability has been resolved: powercap: intel rapl: Fix memory leak in rapl add package cpuslocked When topology physical package id/topology logical die id returns a negative value, rapl add package cpuslocked returns ERR PTR-EINVAL directly without freeing...
PT-2026-104913
In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate byte count in acpi ps get next package length Validate package length reading in acpi ps get next package length...
DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis Via Static Graph and LLM Distillation
The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages are rampant. Malicious code primarily triggers during package installation, import, and runtime. Traditional static analysis fails to understand code semantics; machine...
CVE-2026-88835
BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. Mitigation Do not use the BusyBox dpkg applet to process untrusted .deb packages. Use the full dpkg implementation if Debian package handling is needed...
CVE-2026-63000
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...
ROOT-APP-NPM-CVE-2026-73088 CVE-2026-73088 in browserslist - Patched by Root
Root has patched CVE-2026-73088 in the browserslist package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-73089 CVE-2026-73089 in browserslist - Patched by Root
Root has patched CVE-2026-73089 in the browserslist package for Root:npm. Multiple fixed versions available...
CVE-2026-63000
The REDAXO PHP-based content management system is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 5.21.2 . The rex_api_install_package_update function in redaxo/src/addons/install/lib/api/api_package_update.php fails to override the requiresCsrfProtection() method, w...
CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
ROOT-APP-NPM-CVE-2026-59940 CVE-2026-59940 in seroval - Patched by Root
Root has patched CVE-2026-59940 in the seroval package for Root:npm. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-42198 CVE-2026-42198 in org.postgresql:postgresql - Patched by Root
Root has patched CVE-2026-42198 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...
CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
EUVD-2026-85161
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...