Malicious code in some-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97420170b95f54c404226b47901bbd45ec03ed0a427369b50add75297a2dcb80 Package [email protected] was scanned across 2 files with no a static rule matches and no behavioral findings. No install-time lifecycle execution, n...

CVE-2026-12352

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a...

MAL-2026-6921 Malicious code in jsf-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...

MAL-2026-6924 Malicious code in solana-address-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...

Malicious code in base58-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7d188e2cd79918987f2008e93bb80ea9979d791b357f8f7cfd892321ded6c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-12948

The CVE-2026-12948 vulnerability affects the web management interfaces of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. It is a stored XSS (CWE-79) that permits a remote, authenticated administrator to inject script into certain system configuration fields; the script can exec...

CVE-2026-12352

Technical details (affected products/versions, root cause, exploit conditions, or remediation) are not publicly provided in the supplied documents. Monitor for updates on CVE-2026-12352.

EUVD-2026-42047

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

CVE-2026-12352

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

CVE-2026-12352 Incorrect Authorization

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...

Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access during the May 2025...

nautobot-device-resources (1.0.0), nautobot-ssot (>=2.0.0, <=2.5.0) potentially affected by CVE-2024-34707 via nautobot (>=2.0.0, <=2.2.0)

nautobot PYPI version =2.0.0, =2.0.0, =2.5.0 Source cves: CVE-2024-34707 Source advisory: OSV:PYSEC-2026-1688...

nautobot-device-resources (1.0.0), nautobot-ssot (>=2.0.0, <=2.5.0) potentially affected by CVE-2024-32979 via nautobot (>=2.0.0, <=2.2.0)

nautobot PYPI version =2.0.0, =2.0.0, =2.5.0 Source cves: CVE-2024-32979 Source advisory: OSV:PYSEC-2026-1686...

nautobot-device-resources (1.0.0) potentially affected by CVE-2024-29199 via nautobot (2.0.0)

nautobot PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-device-resources 1.0.0 Source cves: CVE-2024-29199 Source advisory: OSV:PYSEC-2026-1687...

SUSE CVE-2026-13921

Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-14055

Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

MINI-WPHR-V4H5-96HR

Bulletin has no description...

MINI-M65V-29QC-RRW4

Bulletin has no description...

Wireshark parse_report_descriptor() DoS

The vulnerability of the parsereportdescriptor function in the USB HID protocol analyzer of Wireshark, a computer network traffic analyzer, is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...