Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

EUVD-2026-46013

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

CVE-2026-6793

CVE-2026-6793 affects Q-smart NexT Poll by Bifra Engineering Consulting Ltd. The flaw is improper neutralization of input during web page generation, enabling Stored XSS in pages generated before version 1.8.7. CVSS 3.1 base score 5.4 (Medium) with NETWORK impact, LOW privileges, UI required, and...

MSC-2026-6359

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-6358

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-6357

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.

Red Hat Developer Hub 1.9.7 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

UBUNTU-CVE-2026-13577

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

A week in security (July 13 – July 19)

Last week on Malwarebytes Labs: Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords How to use GitHub safely The backlash against Flock cameras is spreading Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom Samsung backs down on threat to delete health data Clau...

Security update for microcode_ctl

This update for microcodectl fixes the following issue: CVE-2025-35979: shared microarchitectural predictor state in VMX non-root operation could lead to data leaks bsc1265189. Changes for microcodectl: Intel CPU Microcode was updated to the 20260512 release bsc1265189: Update for various...

MAL-2026-10837 Malicious code in @gocortexio/npmgremlinbox-malware-network-indicators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d967f359f34a28a80622abb6fea5e47bab0c729e194cec31c48c870568c9f1e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

.NET 9.0 security, bug fix, and enhancement update

9.0.119-1.0.1 - Add support for Oracle Linux 9.0.119-1 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192472 9.0.118-2 - Reduce time to detect hanging builds - Resolves: RHEL-191646...

PT-2026-61624

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7...

PT-2026-61704

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Gitea allows a token with public-only,write:repository restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against t...

Linux Distros Unpatched Vulnerability : CVE-2026-35590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the ran...

PT-2026-62019

These are all security issues fixed in the libsoup-3 0-0-3.6.6-7.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-64022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using...

Cisco ASA/FTD Observable Discrepancy (CVE-2022-20866)

A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key...

Oracle Linux 10 : .NET / 9.0 (ELSA-2026-41895)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41895 advisory. 9.0.119-1.0.1 - Add support for Oracle Linux 9.0.119-1 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 9.0.118-2 - Reduce tim...

Linux Distros Unpatched Vulnerability : CVE-2026-64056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports,...