Malicious code in o3forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d094d4429f1492bb6b99d802de86b97dc972e06d680a1287846e6d1635fe457 The package name impersonates the OpenMRS O3 forms ecosystem legitimate packages are published under the @openmrs/ scope. package.json declares an...

simba-uw-no-tf (>=1.2.9.2, <=1.3.0), simba-uw-tf-dev (>=0.70.0, <=5.6.1) potentially affected by CVE-2024-21485 via dash-core-components (1.10.2)

dash-core-components PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - simba-uw-no-tf =1.2.9.2, =0.70.0, =5.6.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

dragg (0.0.0), dragg-gym (0.0.1) +6 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.3)

dash-html-components PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - simba-uw-no-tf =1.2.9.2, =0.70.0, =0.10.0, =0.1.0, =0.11.1, =0.15.1 Source cves:...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19133 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41850 Source advisory: GHSA-R5W3-XV2F-J59Q...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +7256 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.18)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41853 Source advisory: OSV:GHSA-CJPG-RGQ5-FR37...

CVE-2026-46283

In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfreesensitive to free auth session in tpmdevrelease tpmdevrelease uses plain kfree to free chip-auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data struct...

From cause to cash: a cross-border look at hacktivist activity

While tracking the activities of 4BID we uncovered a new string of campaigns that appear to be the work of several interconnected actors. While politically motivated groups generally limit their scope to specific nations – for 4BID and its peers, primarily Russian and occasionally Belarusian...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +10862 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (>=6.1.0, <=6.2.18)

org.springframework:spring-webmvc MAVEN version =6.1.0, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41844 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254121...

PT-2026-47355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The tpm dev release function uses kfree instead of kfree sensitive to free chip-auth. This structure contains sensitive cryptographic material, including HMAC session keys, nonces, and...

CVE-2026-11450

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument devname results in command injection. It is possible to initiate the attack...

GL.iNet GL-MT3000 command injection vulnerability

GL.iNet GL-MT3000 is a portable travel router from the company GL.iNet, which supports Wi-Fi 6 and VPN functions. Version 4.4.5 of GL.iNet GL-MT3000 has a command injection vulnerability. This vulnerability stems from an incorrect operation of the parameter devname in the function dlopen within t...

CVE-2026-25431

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1...

CVE-2026-50265

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...

Linux Distros Unpatched Vulnerability : CVE-2026-50265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This...

Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Summary The hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded...

PT-2026-46881

Name of the Vulnerable Software and Affected Versions Nhost CLI affected versions not specified Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's...

PT-2026-46848

Summary The hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded...

Microsoft Fixes One-Click GitHub Dev Attack That Let Attackers Steal OAuth Tokens

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code VS Code that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-6873 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-8404 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...