MAL-2026-10531 Malicious code in chain-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabf751a767ad631ac38651254930d99c8ccb0feab8dc5c96b5d3ab243796ddc The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml...

@ynhcj/xiaoyi-channel (>=0.0.1-release20260506, <=0.0.232-next) potentially affected by CVE-2026-62191 via openclaw (2026.6.6)

openclaw NPM version 2026.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @ynhcj/xiaoyi-channel =0.0.1-release20260506, =0.0.232-next Source cves: CVE-2026-62191 Source advisory: SNYK:JS-OPENCLAW-17970561...

PT-2026-58847

Name of the Vulnerable Software and Affected Versions Matter SDK connectedhomeip versions prior to 1.4.0 Description A null pointer dereference occurs in the ReadRevisionAttribute function, which is utilized across several clusters including Channel, Account Login, and TargetNavigator. The issue...

KLA91153 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

Malicious code in node-fsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a0392a3ddea9b6099e8501fdb827f586a410323cecea214aa50fc1be42183b The package tarball ships archive-sender.js, which archives the host path /root/.codex, splits the tar into 200MB chunks, reconstructs an npm registr...

CVE-2026-48849

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:42+00:00| seen| https://t.me/GithubRedTeam/88901 2026-07-14 00:00:41+00:00| seen| https://t.me/GithubRedTeam/88901 2026-07-15 00:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88901...

CVE-2026-11784

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:23+00:00| seen| https://t.me/GithubRedTeam/89640 2026-07-14 00:00:38+00:00| seen| https://t.me/GithubRedTeam/89640 2026-07-15 00:00:17+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/89640...

CVE-2020-8636

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:19+00:00| seen| https://t.me/GithubRedTeam/90443 2026-07-14 00:00:36+00:00| seen| https://t.me/GithubRedTeam/90443 2026-07-15 00:00:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/90443...

CVE-2026-25194

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:07+00:00| seen| https://t.me/GithubRedTeam/92513 2026-07-14 00:00:17+00:00| seen| https://t.me/GithubRedTeam/92513 2026-07-15 00:00:32+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92513...

OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing

A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can...

MAL-2026-10464 Malicious code in node-procmetrics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b [email protected] ships archive-sender.js which, at install/execution, tars the installer's root filesystem excluding /proc, /sys, /dev,...

PYSEC-2026-2422 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Impact An Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability Details In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...

ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

ImpactAn Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability DetailsIn affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...

PYSEC-2026-2705 Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint

Summary Pin/Unpin is a write operation modifies the message's ispinned , pinnedby, pinnedat fields, but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. Details...

PYSEC-2026-2767 Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint

Summary An IDOR vulnerability exists in the Channels feature of Open WebUI, allowing any channel member to modify messages sent by other members including administrators within the same channel. This vulnerability affects the latest version v0.8.12 of Open WebUI. Details In the updatemessagebyid...

PYSEC-2026-2746 Open WebUI's Insecure Message Access Breaks Authorization

Description There's an IDOR in the channels message management system that allows authenticated users to modify or delete any message within channels they have read access to. The vulnerability exists in the message update and delete endpoints, which implement channel-level authorization but...

PYSEC-2026-2720 Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Missing Access Check on Channel Members Endpoint for Standard Channels Affected Component Channel members listing endpoint: - backend/openwebui/routers/channels.py lines 445-507, getchannelmembersbyid Affected Versions Current main branch and likely all versions with the channels feature...

PYSEC-2026-2732 Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected Component Channel membership authorization check: - backend/openwebui/models/channels.py lines 663-673, isuserchannelmember - Used at 15 locations in backend/openwebui/routers/channels.py Affected Versions Current main...

PYSEC-2026-2711 Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Channel Access Grants Bypass filterallowedaccessgrants Affected Component Channel creation and update endpoints: - backend/openwebui/routers/channels.py lines 291-340, createnewchannel - backend/openwebui/routers/channels.py lines 617-638, updatechannelbyid - backend/openwebui/models/channels.py...

PYSEC-2026-3028 pyquorum: Timing side‑channel in mul_mod

Impact The mulmod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand the exponent. An attacker who can measure the time of secret‑sharing operations e.g., via a remote service could progressively recover the valu...