ruby: dlopen could open a library with tainted library name

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names...

TeamPCP Uses Fake Ringtone File in Tainted Telnyx SDK to Steal Credentials

Telnyx issues an urgent alert after hackers TeamPCP uploaded malicious versions 4.87.1 & 4.87.2 of its Python SDK to steal cloud and crypto credentials...

EUVD-2026-14490

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized livescheduleid in Schedulercommands::getAllActiveOrToRepeat...

CVE-2026-33634 Trivy ecosystem supply chain briefly compromised

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious...

MiracleLinux 7 : ruby-2.0.0.648-36.el7 (AXSA:2019-4276:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4276:03 advisory. ruby: HTTP response splitting in WEBrick CVE-2017-17742 ruby: DoS by large request in WEBrick CVE-2018-8777 ruby: Buffer under-read in Stringunpack...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malicious code in ade-lutis21-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23a8f1b0a4e7810d571bc88b0fa79946467d9c0438a3976c8a3b0f5bd220d5d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadi-gembus65-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96a3b49d3954cacd016a3d8ddb997c5beaaba2cc9a390547efbf351102745a99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-93774 Malicious code in continued_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ddccd3c28785778b7f837bdc983b99a9f25cf3d13c30f48fe4cf59a73104f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CLSA-2025-1759866837 kernel: Fix of 44 CVEs

mm: zswap: fix missing folio cleanup in writeback race path CVE-2024-26832 - mm: fix zswap writeback race condition CVE-2023-53178 - dm array: fix releasing a faulty array block twice in dmarraycursorend CVE-2024-57929 - drm/dpmst: Fix MST sideband message body length check CVE-2024-56616 - gpio:...

EUVD-2023-33938

Malicious code in bioql PyPI...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

MAL-2025-44778 Malicious code in jiemi-xiyinli-fazede-zhenxiang (npm)

The package jiemi-xiyinli-fazede-zhenxiang was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2024-40940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rul...

MAL-2025-9462 Malicious code in @taktikangea/quae-vero-sequi (npm)

The package @taktikangea/quae-vero-sequi was found to contain malicious code...

MAL-2025-9009 Malicious code in @malware-test-tipsy-jolls-sider-cares/test-mlw3-tipsy-jolls-sider-cares (npm)

The package @malware-test-tipsy-jolls-sider-cares/test-mlw3-tipsy-jolls-sider-cares was found to contain malicious code...

Malicious code in zaki-bakwan62-sukiwir (npm)

The package zaki-bakwan62-sukiwir was found to contain malicious code...

Malicious code in @malware-test-seifs-impot-basso-koban/test-mlw3-seifs-impot-basso-koban (npm)

The package @malware-test-seifs-impot-basso-koban/test-mlw3-seifs-impot-basso-koban was found to contain malicious code...

MAL-2025-34393 Malicious code in tainted_love (npm)

The package taintedlove was found to contain malicious code...

Architectural Backdoors in Deep Learning: a Survey of Vulnerabilities, Detection, and Defense

Architectural backdoors pose an under-examined but critical threat to deep neural networks, embedding malicious logic directly into a model's computational graph. Unlike traditional data poisoning or parameter manipulation, architectural backdoors evade standard mitigation techniques and persist...