CVE-2026-16461

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump short mode used by rpcinfo -s, version numbers from a remote RPCBPROCDUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or...

EUVD-2026-46185

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump short mode used by rpcinfo -s, version numbers from a remote RPCBPROCDUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or...

CVE-2026-8825

Vulnerability (CVE-2026-8825) : The Elementor Website Builder WordPress plugin prior to 4.1.4 fails to properly enforce permissions on a REST endpoint, allowing authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, a...

MAL-2026-10964 Malicious code in markscan-utils (npm)

The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

MAL-2026-10703 Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...

Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3369fb16804682addfec56904223d0255c2a0ca6d35481e744221e8252f2000d Package publishes as a generic 'M!T' library with an unrelated Apache-license README, but the tarball contains an offensive spam / phishing /...

MAL-2026-10638 Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3369fb16804682addfec56904223d0255c2a0ca6d35481e744221e8252f2000d Package publishes as a generic 'M!T' library with an unrelated Apache-license README, but the tarball contains an offensive spam / phishing /...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of timeout configuration in the http.DefaultClient used for remote post-serve actions. An attacker can exhaust system memory and crash the process by registering a...

MAL-2026-10494 Malicious code in @quickcall/krew (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef7755bfdd2bf753ace888115fd963d8c44147bcf715a0e276f4c6d36208770 The quickcall CLI unconditionally starts a telemetry sync daemon at startup dist/main.js invokes startSyncDaemon and registers a session-end hook plu...

Malicious code in cktool-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ee2228fd4f97fcc261019bf662b6e3006a5aed7a6f3bc0ec4fa505a84aa037 cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolver misroutes the scoped nam...

PYSEC-2026-2526 OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token which provides access to all OpenStack services Ironic is authorized for; o...

MAL-2026-10434 Malicious code in env-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9955128054ee66cd4675be3884e92f9e541ad7e9673496ece60e932c0b83ca5f [email protected] presents as a zero-dependency env loader but on require schedules a 72-hour-delayed activation that POSTs a host fingerprint hostname,...

MAL-2026-10428 Malicious code in sysb1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95e8cd8412bd88621ce6b01197ff69e0dc347d017175fcbfe378cdc036407e27 The package presents itself as a 'System binary configuration tool' but its actual behavior is covert surveillance of the installer. On module load /...

Malicious code in sysb1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95e8cd8412bd88621ce6b01197ff69e0dc347d017175fcbfe378cdc036407e27 The package presents itself as a 'System binary configuration tool' but its actual behavior is covert surveillance of the installer. On module load /...

Malicious code in svg-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f index.js exports getPlugin, which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field...

MAL-2026-10188 Malicious code in awesome-ts-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js - run - packProjectBundle walks the...

Malicious code in @injectivelabs/sdk-ts (npm)

@injectivelabs/[email protected] published 2026-07-08 20:59 UTC contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets durin...

MAL-2026-10159 Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d2c2d224834611b638d571689ba89e7ad9b15f59f68a01f403056d02c9278c9 On npm install, [email protected] runs postinstall.js which calls integrate to silently modify the installer's own source tree without prompt or...

Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...