MAL-2026-10391 Malicious code in tipsen-last (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8dda277dd82e1c50906cff18341bb76485eed33ba42d39b228c447514e4081f package.json declares its only runtime dependency "safe-chain-test" as a direct tarball URL on hoped-twice-evaluation-site.trycloudflare.com — an...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the DOM: Core & HTML component...

MAL-2026-10218 Malicious code in pure-folder-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e83bf74d7c84c48a1a478d7bb40bbd899c4fda613f1512b66184d3de478b480 [email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry src/build.js decodes an obfuscate...

SingGuard-NSFA: Extensible Guardrails for Agentic AI Via Generative Reasoning and Real-Time Classification

We present nsfaguard, a guardrail framework for securing agentic AI systems against operational threats, such as prompt injection, sensitive information extraction, malicious code requests, dangerous tool misuse, and resource exhaustion. We first introduce the NSFA taxonomy, which organizes 185...

PT-2026-59672

An issue in OpenFUN Richie LMS in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync course run from request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring...

GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework

Time Division Duplex TDD mobile networks require synchronization accuracy of $\pm$1.5 $μ$s 3GPP TS 38.104, with GNSS-disciplined grandmaster clocks as the predominant timing source. GNSS spoofing -- now a documented operational threat -- can corrupt timing across all downstream base stations, yet...

PT-2026-57903

Name of the Vulnerable Software and Affected Versions FlashAttention versions prior to 2.8.3.post1 Description A symlink attack exists in the download and copy function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filterin...

Apache IoTDB authorization issue vulnerability (CNVD-2026-28234)

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. Versions of Apache IoTDB from 1.3.3 to 2.0.8 contained an authorization vulnerability. This vulnerability stemmed from the lack of strict validation of the sessionId parameter by certain Thrift RP...

PT-2026-59671

Summary An Authorization Bypass vulnerability in rfc3161-client's signature verification allows any attacker to impersonate a trusted TimeStamping Authority TSA. By exploiting a logic flaw in how the library extracts the leaf certificate from an unordered PKCS7 bag of certificates, an attacker ca...

GDM AI Control Roadmap

AI agents are rapidly accelerating work at frontier AI companies, helping with AI R&D, cyber-defence, and advancing scientific discoveries. As these agents become more tightly integrated into our systems, unlocking their full potential requires rethinking how we do security. We should not assume...

PT-2026-57912

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a...

PT-2026-59590

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate restricted url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

PT-2026-59372

Summary The LDAP and OAuth authentication flows use a TOCTOU Time-of-Check-Time-of-Use pattern for first-user admin role assignment. The regular signup handler signup handler in auths.py, line 663 was explicitly patched to prevent this race with the comment "Insert with default role first to avoi...

PT-2026-59301

Summary A ReDoS Regular Expression Denial of Service vulnerability in LINK TITLE RE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with...

TOTOLINK A8000RU CGI Handler setNtpCfg Command Execution

The vulnerability of the setNtpCfg function in the /cgi-bin/cstecgi.cgi file of the CGI Handler component of the TOTOLINK A8000RU router’s software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary command...

PT-2026-59302

Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately On² behavior in parse link text. A relatively small input consisting of repeated characters causes significant parsing slowdown. Affected component mistune/inline parser.py → parse link text Description When...

glib2: Fix of 2 CVEs

CVE-2026-58011: out-of-bounds read from an invalid GDateTime produced by gdatetimeaddfull without range validation, later read by gdatetimegetymd - CVE-2026-58013: heap buffer over-read in giochannelreadlinebackend when a multi-byte line terminator is memcmp'd past the end of the buffer...

MAL-2026-10198 Malicious code in polylabel-web-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce7df46acd8236fafbaa27dbccb92d1f286c17b023ea5ff555700e76c4a0188f [email protected] ships an empty index.js stub and declares its only runtime dependency as a direct tarball URL on a Google Cloud Storage...

[SECURITY] Fedora 44 Update: python-tornado-6.5.7-1.fc44

Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks and certainly most Python frameworks because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle...