MAL-2026-10446 Malicious code in react-markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da0db97919f41757fe4bcdc456d52ec0ecfbb89741438e5805a7bf5188b022c5 [email protected] is a typosquat of markdown-table declared repo field wooorm/markdown-table. package.json declares a preinstall hook that...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

CVE-2026-61952

creationtimestamp| type| source ---|---|--- 2026-07-13 12:06:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjnq45wys2i 2026-07-13 22:18:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpwprsmj2z 2026-07-16 07:58:36+00:00| seen|...

Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling

Meta has filed a patent application for an AI that listens to your voice throughout the day, works out how it thinks you are feeling from the way you sound, and keeps a timestamped log of every read. Each read gets pinned to the moment it happened: the time, your location, what you were doing, ev...

CVE-2026-53606

creationtimestamp| type| source ---|---|--- 2026-07-13 11:50:20+00:00| seen| https://bsky.app/profile/mfahlandt.bsky.social/post/3mqjmswsvuj2c...

CVE-2026-57741

creationtimestamp| type| source ---|---|--- 2026-07-13 11:25:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjlhebvkm2y...

SUSE-SU-2026:22598-1 Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

CVE-2026-57743

creationtimestamp| type| source ---|---|--- 2026-07-13 10:47:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjjbruxca2l 2026-07-13 22:11:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpjijgpa2a 2026-07-16 08:11:42+00:00| seen|...

CVE-2026-15536

creationtimestamp| type| source ---|---|--- 2026-07-13 07:43:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6zww6kb22...

Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

MAL-2026-10405 Malicious code in @torbeck/heap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10407 Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10411 Malicious code in cookie-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f The package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a...

MAL-2026-10391 Malicious code in tipsen-last (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8dda277dd82e1c50906cff18341bb76485eed33ba42d39b228c447514e4081f package.json declares its only runtime dependency "safe-chain-test" as a direct tarball URL on hoped-twice-evaluation-site.trycloudflare.com — an...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the DOM: Core & HTML component...

MAL-2026-10218 Malicious code in pure-folder-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e83bf74d7c84c48a1a478d7bb40bbd899c4fda613f1512b66184d3de478b480 [email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry src/build.js decodes an obfuscate...

Apache IoTDB authorization issue vulnerability (CNVD-2026-28234)

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. Versions of Apache IoTDB from 1.3.3 to 2.0.8 contained an authorization vulnerability. This vulnerability stemmed from the lack of strict validation of the sessionId parameter by certain Thrift RP...

PT-2026-57903

Name of the Vulnerable Software and Affected Versions FlashAttention versions prior to 2.8.3.post1 Description A symlink attack exists in the download and copy function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filterin...