CVE-2026-7059: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function getsimulationposts of the file backend/app/api/simulation.py of the component Query Parameter Handler. Performing a manipulation of the argument Platform results in path traversal. The attack can be initiated...

CVE-2026-7042: Missing Authentication for Critical Function

A flaw has been found in 666ghj MiroFish up to 0.1.2. This affects the function createapp of the file backend/app/init.py of the component REST API Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published a...

Malicious code in robase-library-quick-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3655afd9220b8d5df96a51d63e383fd4face5be5f31a2da02bcaf379d6625c6b During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in process-app-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9459ef3208e8a07fbb99a80ce6bc5f0a6b9c6511da51241bac7c034632b7e1 The package process-app-task was found to contain malicious code. Source: ghsa-malware e03db779eee12801bb79b31d14cb5519f499b54a039c4428b125a23c26a652...

MAL-2026-3039 Malicious code in process-app-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9459ef3208e8a07fbb99a80ce6bc5f0a6b9c6511da51241bac7c034632b7e1 The package process-app-task was found to contain malicious code. Source: ghsa-malware e03db779eee12801bb79b31d14cb5519f499b54a039c4428b125a23c26a652...

CVE-2026-6990

A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descrição results in cross site scripting. The attack can be initiated remotely. The exploit has been made...

CVE-2026-41327

creationtimestamp| type| source ---|---|--- 2026-04-25 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116463109926067503 2026-04-25 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkc2esawbu2m 2026-05-30 16:37:07+00:00| seen|...

[SECURITY] Fedora 44 Update: nheko-0.12.1-16.fc44

The motivation behind the project is to provide a native desktop app for Matrix that feels more like a mainstream chat app...

[SECURITY] Fedora 44 Update: goose-1.23.2-8.fc44

Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...

CVE-2026-41492

creationtimestamp| type| source ---|---|--- 2026-04-25 01:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116462756162944901 2026-04-25 01:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mkbvdwkbgc2v 2026-04-26 05:59:11+00:00| seen|...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...

CVE-2026-41477

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary...

Malicious code in @alfa.life.mapp/app.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31f4eb43fd465a585f96a6ae24d86885dcb21e0645e446d9831edce30250a9e The package @alfa.life.mapp/app.web was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3065 Malicious code in @m0ntana/app.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffd5d049b453ec288428ae1c5b369effbc0397e753720aeb3900a746bb83519 The package @m0ntana/app.web was found to contain malicious code. Source: ghsa-malware b7fdecb35a1116b81d1340d7d6cc748a050b4dde46beb279a40f6e049955ca...

CVE-2026-40533

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40531

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases

Cybersecurity researchers have discovered a set of malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets in an attempt to steal recovery phrases and private keys since at least fall 2025. "Once launched, these apps redirect users to browser pages designed to look...

darkmarket-vuln-lab

🕶️ Dark Market Simulator An intentionally vulnerable CTF-...

CVE-2026-1950

creationtimestamp| type| source ---|---|--- 2026-04-24 08:14:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mka3hjof4t2n 2026-04-24 09:16:19+00:00| published-proof-of-concept| Telegram/X1JyBiiNxoSYu-ldDRrQFjaq89QLca8O12-lN-DTEtiPeU 2026-05-11 19:37:07+00:00| seen|...

CVE-2026-41430

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...