CVE-2026-63272

A flaw was found in LibreOffice. When processing embedded Windows Metafile WMF graphics, a heap buffer overflow can occur during the import of text records. This vulnerability arises because the application reads the character advance values and text length independently, which can lead to a...

MAL-2026-13650 Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

CVE-2026-61477 Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-61477 Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

MAL-2026-13574 Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

Malicious code in dolyame-ui-scrollblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9 On require of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments...

MAL-2026-13570 Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

Malicious code in dolyame-ui-iconspack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles...

Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...

Malicious code in delivery-ci-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25daa792f30733f69d4530266b44c1b6ba9a5f4d11f47cce95b714792a39ca89 On require of delivery-ci-cli, index.js loads bootstrap.js which downloads a platform-specific native binary from string-split-obfuscated Cloudflare...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

MAL-2026-13503 Malicious code in distributorblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea The package's main entry index.js re-exports a decoy telemetry module and unconditionally requires setup.js. On require, setup.js selects a...

Malicious code in bigops-outgoing-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 536ee260eadf72447df4e01eb549a86779846d21b3b9b539b486f2bcd65ba750 On require of index.js the package loads runtime.js, which selects a platform-specific asset path and fetches an opaque binary from one of four...

Malicious code in bigops-procedure-file-handlers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c15f49a67f4aa7071f4143a57c729f98dae58b01eb58ac77aabc666f1a1dda0 On require of the package, runtime.js downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints hostnames reassembled at...

MAL-2026-13233 Malicious code in bigops-procedure-file-handlers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c15f49a67f4aa7071f4143a57c729f98dae58b01eb58ac77aabc666f1a1dda0 On require of the package, runtime.js downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints hostnames reassembled at...

Malicious code in bigops-procedure-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e28923577eff8eba09d7ebbd941220727c1851cf46ef25f4de8960070ad33bb On require, index.js loads loader.js, which reconstructs delivery hostnames at runtime via array.join"" e.g. oob-worker.cf102-baf.workers.dev,...

Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...