CVE-2026-24402

GitHub cannot issue a CVE for this Security Advisory because this advisory includes information about more than one vulnerability. According to rule 4.2.11 of the CVE CNA rules: 4.2.6 CNAs SHOULD assign different CVE IDs to separate Vulnerabilities, as determined using the guidance in 4.1. 4.2.11...

MAL-2026-454 Malicious code in @mailpoet/component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d48b40574c65ef747944583fa5a49ac40b673d6932a02247c2cdbd5331a79179 The package @mailpoet/component was found to contain malicious code. Source: ghsa-malware...

MAL-2026-385 Malicious code in blocks-builder-manifest-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30f5efa34a1c44d974502110177cb7a60daf579349ed25937e66e342f7f7c24f The package blocks-builder-manifest-generator was found to contain malicious code. Source: ghsa-malware...

MAL-2026-339 Malicious code in internallib_v355 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dba9a4166fd959eea5357952f1ffba736b4e6c9176ddeff85e0aeb1592edef8 The package internallibv355 was found to contain malicious code. Source: ghsa-malware 41e49779a105339cef2addb161d2a79d3aa2e22201f862ba6c3ef2af1ab1ccd...

MAL-2026-231 Malicious code in pinecone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c597ee3d643e51ba6eca0553a77be1c79a3e5dc72d8450b09b7f405a558d2d56 The package pinecone-js was found to contain malicious code. Source: ghsa-malware 0e6ef1006a92156684ab8d3e78ab8e036d4c27f591eba5212441a68be8231a66 An...

SUSE CVE-2024-53866

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

Malicious code in eslint-supertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06b784b251ddb3666b203fa36b7e7cd4e9101ff8c468c9d32423a398f40a6689 The package eslint-supertest was found to contain malicious code. Source: ghsa-malware 01ffd1e84f1255f84c7876957e188eed9ab1dad03915006b9f463510c22590...

CVE-2023-54095

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses failiommusetup registers the failiommubusnotifier struct to both PCI and VIO buses. struct notifierblock is a linked list node, so this causes any notifiers later...

UBUNTU-CVE-2023-54095

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses failiommusetup registers the failiommubusnotifier struct to both PCI and VIO buses. struct notifierblock is a linked list node, so this causes any notifiers later...

CVE-2023-54095 powerpc/iommu: Fix notifiers being shared by PCI and VIO buses

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses failiommusetup registers the failiommubusnotifier struct to both PCI and VIO buses. struct notifierblock is a linked list node, so this causes any notifiers later...

MAL-2025-192657 Malicious code in yt-smm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3641ecf42237a55c9fb81c4368aa7b83a42d2110a64a733f45d27005cf38dc26 The package yt-smm was found to contain malicious code. Source: ghsa-malware b4d96978cd4e109ed8b360f551af24fd1621dd659f63a490c9de077b587f607b Any...

MAL-2025-192583 Malicious code in swissid-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68ce12ad99bb87750b22a3aa2c0d4bae036e647f446f6c05eb46b7fad1571d13 The package swissid-common was found to contain malicious code. Source: ghsa-malware 2657ec223bbf476c870a3f34e60928d95b1512176e7762f2c01a9aa759f75d98...

Malicious code in portal-lim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff3dc977380263ed801e45db7d242fb194b66d319545d913fd30087e7c4b274 The package portal-lim was found to contain malicious code. Source: ghsa-malware 9368b862e0bcedf32684551fa238a7364f7214a84bae4597cff992d6ca8b2993 Any...

SUSE CVE-2022-50616

In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd...

MAL-2025-192295 Malicious code in elf-stats-jubilant-ornament-641 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b627f81ef3d4b49b83a86d60778eb2510e4d1cc4a7d0786394c115f194b9264 The package elf-stats-jubilant-ornament-641 was found to contain malicious code. Source: ghsa-malware...

Malicious code in jquery-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31127dd6191c9d3e68e94d705b43d24066f06f37b41f659a5a6831a8a811fc11 The package jquery-bindings was found to contain malicious code. Source: ghsa-malware eb6c4671167bd91b31b632f661a4bc8a3d627412796b9899fae3d0797eb51e3...

Malicious code in orchestrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732fc5c54ff5b647980dececa3d55359ca48b380f00beb4845ddfbcc9c968af4 The package orchestrix was found to contain malicious code. Source: ghsa-malware 68b12d5467e82141efec319259cd3c7331cd739fef7932534ebdf9692980ab74 Any...

MAL-2025-190770 Malicious code in dotnet-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b8736e74e763b930253cc92ff8ee4e0b0c323b712ea201cd40c8590f618b72 The package dotnet-template was found to contain malicious code. Source: ghsa-malware 01d263352d7df50818b3c0bfb8c2c2b4c30e78dcf1feadeb4b808c2636b9c6a...

SUSE CVE-2025-40152

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separategpudrm modparam The drmgemforeachgpuvmbo call from lookupvma accesses drmgemobj.gpuva.list, which is not initialized when the drm driver does not support DRIVERGEMGPUVA feature. Enable it fo...

CVE-2025-40152

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separategpudrm modparam The drmgemforeachgpuvmbo call from lookupvma accesses drmgemobj.gpuva.list, which is not initialized when the drm driver does not support DRIVERGEMGPUVA feature. Enable it fo...