Malicious Package

Overview btree-range-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range

A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...

The vulnerability of the arena_alloc_pages() function in the kernel/bpf/arena.c module, which is part of the BPF interpreter support for Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the arenaallocpages function in the kernel/bpf/arena.c module, which is part of the Linux kernel’s BPF interpreter support, relates to the comparison of numerical ranges without any minimum checks during request processing. Exploiting this vulnerability could allow an attacke...

GHSA-XQQH-3W52-Q8P7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.3-rails, ruby3.4-rails...

Malicious code in btree-range-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7b5c5ccd56296e8ac25007af040c62f078c5953946fdae9fc1c67b0178f65f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15876 Malicious code in btree-range-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7b5c5ccd56296e8ac25007af040c62f078c5953946fdae9fc1c67b0178f65f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

DRUPAL-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1082 more potentially affected by CVE-2026-83610 via @xmldom/xmldom (>=0.9.0, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...

CVE-2026-81165

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18...

CVE-2026-73478

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1...

@343dev/optimizt (>=12.0.0, <=13.0.0), @agilebot/vitepress-preset (>=0.8.9, <=0.9.6) +79 more potentially affected by CVE-2026-84370 via svgo (>=4.0.0, <=4.0.2)

svgo NPM version =4.0.0, =12.0.0, =0.8.9, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =2.47.0, =0.16.2, =1.3.0-next.0, =3.0.0-next.0, =6.13.0, =0.0.1769658265953, =21.2.6, =1.6.9, =0.1.0-dev.00e4942, =0.3.0 and more Source cves: CVE-2026-84370 Source advisory: SNYK:JS-SVGO-19498539...

EUVD-2026-66347

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4809 more potentially affected by CVE-2026-84371 via sanitize-html (>=1.10.1, <=2.17.6)

sanitize-html NPM version =1.10.1, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =11.1.0, =11.3.0 and more Source cves: CVE-2026-84371 Source advisory: SNYK:JS-SANITIZEHTML-19498541...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-101043 via pnpm (>=10.8.1, <=10.33.2)

pnpm NPM version =10.8.1, =0.1.0, =1.1.1, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-101043 Source advisory: OSV:GHSA-VX52-2968-3VC6...

@forgeax/game (>=0.3.0, <=0.3.10), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +9 more potentially affected by CVE-2026-101043 via pnpm (>=11.5.3, <=11.7.0)

pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-101043 Source advisory: OSV:GHSA-VX52-2968-3VC6...

CVE-2026-18780

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18931 Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18630 SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...