CVE-2026-86504

JetBrains IntelliJ IDEA versions prior to 2026.2.2 are affected by a vulnerability where a missing project-trust confirmation before building a Dev Container allows host-level code execution . The flaw requires local access and user interaction but no prior privileges, yielding HIGH impact on con...

CVE-2026-86504

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...

RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

PT-2026-86876

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...

CVE-2026-86504: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...

PT-2026-95055

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

gulu-ui (>=0.0.6, <=0.0.7) potentially affected by unknown CVE via dev-test (0.0.1-security)

dev-test NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on dev-test and may be impacted: - gulu-ui =0.0.6, =0.0.7 Source cves: unknown CVE Source advisory: GHSA-JMPP-FW65-X36Q...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053282 advisory. In the Linux kernel, the following vulnerability has been resolved: resource: fix regionintersects vs addmemorydrivermanaged On a system with CXL memory, the resourc...

Malicious Package

Overview vitest-cli-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

CVE-2026-80253

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-80253

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-80253

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-80253

CVE-2026-80253 is an improper physical access control flaw in ShizenBox2 (dev-conf) . An attacker with physical access to the device can execute bootloader commands without authentication , leading to high impact on confidentiality, integrity, and availability. The vulnerability is rated 6.8 (Med...

PT-2026-90881

In the Linux kernel, the following vulnerability has been resolved: af packet: Don't send zero-byte data in tpacket snd. syzbot reported a WARNING in dev queue xmit triggered via tpacket snd: skb assert len WARNING: at include/linux/skbuff.h:2753 skb assert len WARNING: at dev queue...

PT-2026-84971

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-80253: Improper Physical Access Control

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...