A path traversal vulnerability in the kitty graphics protocol handler of rio-vt allows an attacker to delete and read files outside the intended temporary directory. The flaw arises because the handler only checks if the file path contains a specific substring without rejecting directory traversal sequences, enabling escape from the temp directory. This affects any application using rio-vt that renders untrusted output. The vulnerability is fixed in rio-vt version 0.5.29.
The npm package axelarjs-sdk@1.0.1 is a malicious package that contains no functional code but executes a preinstall script during installation. This script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information to an attacker-controlled endpoint.
The npm package 'sol-wallet-adapter' versions 1.0.0, 1.0.1, and 1.0.7 are malicious. These versions contain no functional code but execute a preinstall script that sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package was published by suspicious accounts and communicates with a domain linked to malicious activity.
The npm package cutekitten-test@1.0.1 contains malicious code that executes during installation. Its preinstall script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package has no functional code beyond this data exfiltration behavior.
The npm package calculator-preinstall-hook-demo version 1.1.2 contains malicious code that executes a preinstall script during installation. This script sends the machine's hostname and OS username to a Discord webhook, potentially leaking sensitive environment information. The package was published by the npm account bigdevin55 and is pulled in as a dependency by calculator-preinstall-chain-demo@1.1.2.
The npm package calculator-preinstall-chain-demo versions 1.1.1 and 1.1.2 is identified as malicious. It does not have its own install script but depends on calculator-preinstall-hook-demo@1.1.2, which runs a preinstall script that sends the machine's hostname and OS username to a Discord webhook. This behavior is considered malicious due to unauthorized data exfiltration.
A critical security vulnerability (CVE-2026-98432) exists in the Linux kernel's IPv4 implementation related to freeing inet_opt and ireq_opt after an RCU grace period. This flaw affects Red Hat Enterprise Linux 8 kernel packages prior to version 4.18.0-553.182.1.el8_10. A security update has been released by Red Hat to address this issue, and a system reboot is required to apply the fix.
`ant-releases` crate versions from 0.0.0-0 onwards contain a path traversal vulnerability in the archive extraction function. The vulnerability allows crafted ZIP archives with entries containing relative paths (e.g., '../') to write files outside the intended destination directory, potentially overwriting arbitrary files on the host system.
`codeq` is a Rust serialization library with a vulnerability in its `Decode` trait implementations for `String` and `Vec<u8>`. The decoding process reads a 4-byte big-endian length prefix from input and allocates memory of that size before reading the actual payload. Because there is no upper bound or validation on this length, an attacker can supply a small input that causes the library to allocate up to approximately 4 GiB of memory, leading to uncontrolled resource consumption and potential denial of service via out-of-memory conditions. This issue affects all versions prior to 0.6.3. The vulnerability is fixed in version 0.6.3, where the decode buffers grow dynamically as payload bytes arrive instead of pre-allocating the full length.
A vulnerability in pulldown-cmark versions 0.13.0 up to but not including 0.13.6 allows quadratic parsing time when the ENABLE_WIKILINKS option is enabled. This occurs due to nested image wikilinks causing repeated rescanning of content, leading to a denial-of-service impact. The issue is fixed in version 0.13.6.
A vulnerability in the MessagePack C extension causes an unbounded memory leak when strict_map_key validation fails. This issue affects version 3.0 of the affected software. No CVSS score or detailed impact information is provided, and no patch or fix information is available.
This vulnerability, identified as CVE-2026-98925, involves a flaw in the bpf sockmap component related to self-redirect copied_seq double-counting. The issue affects Microsoft products versions 3.0 and 4.0. No CVSS score or detailed impact information is provided in the available data.
CVE-2026-98915 is a vulnerability related to the media: video-i2c driver in Microsoft software versions 3.0 and 4.0. The issue involves the use of vb2_video_unregister_device on driver removal. No further technical details or impact information are provided.
This vulnerability, identified as CVE-2026-98913, relates to a reference leak in the Precision Time Protocol (PTP) device handling within the nicvf_probe() function in Microsoft software. The issue involves a resource leak that could potentially affect device stability or performance. The affected versions are specifically version 3.0 and 4.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of exploitation in the wild. No patch or remediation details are included in the available data.
This vulnerability, identified as CVE-2026-98912, relates to the ALSA sequencer OSS interface rejecting reads that cannot fit the next event. The advisory provides no detailed technical information or impact description. The affected versions are Microsoft products version 3.0 and 4.0. No CVSS score or exploit details are available.
CVE-2026-98911 is a vulnerability related to the dpaa2-switch component, specifically addressing an error path in the dpaa2_switch_rx() function. The information provided does not include details on the nature of the flaw, its impact, or exploitation methods. The affected versions are Microsoft product versions 3.0 and 4.0. No CVSS score or detailed impact analysis is available.
CVE-2026-98910 is a vulnerability related to the drm/amdkfd component in Microsoft software, involving an unwind debug trap triggered on copy_to_user failure. The advisory provides no further technical details or impact description.
CVE-2026-98909 is a vulnerability related to the net: cpsw_new component where device link unregistration fails upon port registration failure. The advisory does not provide detailed technical information or impact specifics.
This vulnerability, identified as CVE-2026-98908, relates to the net: microchip: sparx5 component and involves cleaning up PSFP resources on flower setup failure. The information provided is minimal and does not describe the nature of the flaw, its impact, or exploitation details. The affected versions are Microsoft product versions 3.0 and 4.0. No CVSS score or detailed technical impact is available.