Malicious code in 3layerdipstackgqt6yc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04c59714eecb0470fad815ea33918fb40a82d7d9e73da4be2cd14575961183d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackdci73 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a82c7c1f8ba34fecbc15f45466f7794403b94aab19378524b05c9fee83c92e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack9ma2d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19f56ed19a408b179769ab113af64880f60ddb0ad671a983ecaab4fd804c61a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in waxed-slightly-weathered-cut-copper-stairs-3xt74ldh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 125aa8a7ecbe76dbb501f7fc47defca2480a50f4b7e38a7cdc848ff1c15b2994 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-l5t17nyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9ad99fa93d6470ff0e403af07ba26efa2a2c72dab859da20722eaa768d9d364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-w7am2h4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a587a6a9d79a435737148758d763bbb316e529fac1e72eca1d57764886a442f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-csh3v6cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4dac329ff5e34f65f8b47e3c1f6c0245bd2752fee6c0993b90f15b397c092ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-vulrfg00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dce79d9f109ae4132ce031ad16decf56259c490c10880bcde7f6886e85f5bcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ameyqv97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a475aa608722e5a021edae81a8e2b4848eb991b51a9b2dead74446bb6466ae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-40204

None None None No publicly available exploits are known...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to information disclosure (CVE-2025-14483)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed information disclosure security vulnerability Vulnerability Details CVEID:CVE-2025-14483 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51,...

LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment

Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model LLM-based agents, which can plan, use tools, retain state, and revise actions across multi-step...

PT-2026-83132

Name of the Vulnerable Software and Affected Versions Akilli Ticaret Software Technologies Ltd. E-Commerce Pack versions 4.5.001 through 28082026 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts...

The vulnerability of Adminer’s database management software lies in its improper external handling of file names or paths, allowing attackers to execute arbitrary code.

The vulnerability of Adminer’s database management software lies in improper external manipulation of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-11754

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-81097

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...