MAL-2026-10073 Malicious code in tailwind-animate-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd43366b04ea80c2244079c09602623af157ce00cba9ae1837005b97ffe44bdb The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source including its original author...

CVE-2026-4275

creationtimestamp| type| source ---|---|--- 2026-07-09 14:57:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7vgdjneg26 2026-07-10 00:00:27+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqatqsu5rv2o...

CVE-2026-4256

creationtimestamp| type| source ---|---|--- 2026-07-09 14:52:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7v5f3nus2i...

CVE-2025-58151

CVE-2025-58151 affects varstored, a Xen/Xapi component that handles UEFI variables and maps guest memory to OVMF. The vulnerability arises from TOCTOU due to insufficient compiler barriers in the shared buffer, with exploitation depending on compiler-generated code, and the attacker potentially c...

CVE-2025-58151

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...

CVE-2025-58151 varstored: TOCTOU issues with mapped guest memory

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The...

CVE-2026-15170

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

unbound: Unbound: Cache manipulation via 'ghost domain names' attack

A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain a "ghost zone" and querying a vulnerable Unbound server, could exploit a vulnerability related to "ghost domain names" attacks. This could allow the attacker to overwrite cached Name Server NS records,...

CVE-2026-58303

creationtimestamp| type| source ---|---|--- 2026-07-09 12:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7o4uy5hk2t...

Malicious code in playwrightr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e165b925f82629524e611c81597c32a171df7cec246dc73f268d8192ccbe2c5 setup.py registers a CustomInstallCommand that runs automatically on pip install under Windows. It uses WinHTTP via ctypes to fetch a binary from...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

MAL-2026-10012 Malicious code in mchain-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5249b7e6ec4cba8f4a3b2d332ec69069c1ca39eabec04a1372500ea25952280 package.json declares a postinstall hook node./src/core/index.js. That module immediately runs a top-level async IIFE that base64-decodes a URL store...

OESA-2026-2971 gzip security update

gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz. Security Fixes: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

OESA-2026-2969 gzip security update

gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz. Security Fixes: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

CVE-2026-12590

creationtimestamp| type| source ---|---|--- 2026-07-09 10:29:15+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mq7gg7lj5s2d 2026-07-10 05:29:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg5qdepx2e 2026-07-21 05:31:05+00:00| seen|...

CVE-2026-14245

creationtimestamp| type| source ---|---|--- 2026-07-09 09:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116889198686002131 2026-07-09 09:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq7bhkabxp24 2026-07-09 22:30:57+00:00| seen|...

CVE-2026-14342

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contactids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-11869

creationtimestamp| type| source ---|---|--- 2026-07-09 08:01:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq766nzxj42g...

CVE-2026-11571

creationtimestamp| type| source ---|---|--- 2026-07-09 07:59:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq762jnkum25 2026-07-09 17:47:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6wauter26...

CVE-2026-14342

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contactids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of...