Malware in real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

ShadeBIOS

Shade BIOS README is present in each Pkg folder ModuleLoaderPkg: DXE module that loads & executes DXE modules from a USB stick ShadeBiosPkg: Main Shade BIOS package VarPrintPkg: Library that allows printing debug messages or statuses to the UEFI variables Author Kazuki Matsuo. © FFRI Security, In...

How Intervention History Changes AI Agent Sabotage on Subsequent Tasks

AI control evaluations often reset agents' memory between tasks, although deployed agents may retain records of prior interventions. We ask whether learning that an earlier attack was caught changes an agent's ability to evade defer-to-trusted DtT, a protocol that replaces suspicious work with a...

CVE-2026-88046: Improper Limitation of a Pathname to a Restricted Directory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

Malicious Package

Overview Shade.WPF.Controls is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

org.apache.cxf.systests:cxf-systests-rs-security (3.5.7), org.apache.cxf:apache-cxf (3.5.7) +5 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.5.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf.systests:cxf-systests-rs-security 3.5.7 -...

org.apache.cxf.systests:cxf-systests-rs-security (3.5.7), org.apache.cxf:apache-cxf (3.5.7) +5 more potentially affected by CVE-2026-50628 via org.apache.cxf:cxf-rt-rs-security-oauth2 (3.5.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 3.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf.systests:cxf-systests-rs-security 3.5.7 -...

Malicious code in stormbreaker-shade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c845d690b6091601683bf61bdd858e5579c2fd4d33b770806b1bb113e9533f1 The package stormbreaker-shade was found to contain malicious code...

MAL-2026-2392 Malicious code in stormbreaker-shade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c845d690b6091601683bf61bdd858e5579c2fd4d33b770806b1bb113e9533f1 The package stormbreaker-shade was found to contain malicious code...

SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents

As Large Language Models LLMs are increasingly deployed as autonomous agents in complex and long horizon settings, it is critical to evaluate their ability to sabotage users by pursuing hidden objectives. We study the ability of frontier LLMs to evade monitoring and achieve harmful hidden goals...

com.dtstack:dt-insight-hive-shade (>=4.1.2-release, <=4.1.3), io.eels:eel-hive_2.11 (1.0.2) +4 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.1.0)

org.apache.hive:hive-exec MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.dtstack:dt-insight-hive-shade =4.1.2-release, =2.6.1, =2.6.1, =2.7.1 Source cves: CVE-2024-29869 Source...

SUSE-RU-2024:3971-1 Recommended update for mojo-parent

This update for mojo-parent fixes the following issues: xalan-j2 was updated from version 2.7.2 to 2.7.3: - Security issues fixed: CVE-2022-34169: Fixed integer truncation issue when processing malicious XSLT stylesheets bsc1201684 - Changes and Bugs fixed: Java 8 is now the minimum requirement...

mupdf:pdf_fuzzer: Heap-buffer-overflow in eval_sample_func

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4590883746414592 Project: mupdf Fuzzing Engine: honggfuzz Fuzz Target: pdffuzzer Job Type: honggfuzzasanmupdf Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x51400020c9d0...

Malicious code in Shade.WPF.Controls (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Fedora: Security Advisory for maven-shade-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: maven-shade-plugin-3.5.1-4.fc40

This plugin provides the capability to package the artifact in an uber-jar, including its dependencies and to shade - i.e. rename - the packages of some of the dependencies. %javadocpackage...

com.sngular:scc-multiapi-converter (3.4.0), gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=3.1.0, <=3.1.9) +17 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=3.1.0, <=3.1.9)

org.springframework.cloud:spring-cloud-contract-shade MAVEN version =3.1.0, =3.1.0, =0.32.0.release, =2.3.0, =4.4.6, =4.4.6, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.9 - org.springframework.cloud:spring-cloud-contract-stub-runn...

gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=4.0.1, <=4.0.4), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (>=4.0.0, <=4.0.4) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=4.0.0, <=4.0.4)

org.springframework.cloud:spring-cloud-contract-shade MAVEN version =4.0.0, =4.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.4 Source cves: CVE-2024-22236 Source advisory: OSV:GHSA-P6RP-MX85-M459...

gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (>=4.0.1, <=4.0.4), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (>=4.0.0, <=4.0.4) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (>=4.0.0, <=4.0.4)

org.springframework.cloud:spring-cloud-contract-shade MAVEN version =4.0.0, =4.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.4 Source cves: CVE-2024-22236 Source advisory: GHSA-P6RP-MX85-M459...

gradle.plugin.org.springframework.cloud:spring-cloud-contract-gradle-plugin (4.1.0), org.springframework.cloud.contract:org.springframework.cloud.contract.gradle.plugin (4.1.0) +10 more potentially affected by CVE-2024-22236 via org.springframework.cloud:spring-cloud-contract-shade (4.1.0)

org.springframework.cloud:spring-cloud-contract-shade MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-contract-shade and may be impacted: -...