MAL-2026-163 Malicious code in do-not-install-this-package-002 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc0f1ed2645f37e4b8df59ccca64288a02f6cc07009489c54565dfc5b0089f19 During installation, the package exfiltrates env variables and data from different process memory to a remote location --- Category: MALICIOUS - The campaign h...

ALSA-2026:0312 Moderate: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack CVE-2025-584...

Moderate: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack CVE-2025-584...

CVE-2019-12505

Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In...

CVE-2019-12506

Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target...

CVE-2025-1813

A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2024-2620

A vulnerability has been found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this vulnerability is an unknown functionality of the file api/client/downfile.php. The manipulation of the argument uuid leads to sql injection. The...

CVE-2024-2900

A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. It is possible to initiate th...

CVE-2025-14979 Eddie VPN 2.24.6 - Local Privilege Escalation

AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6...

CVE-2025-14979

AirVPN Eddie on macOS is affected by CVE-2025-14979 due to an insecure XPC service that allows local, unprivileged users to escalate privileges to root. Affected version: Eddie 2.24.6. Documented impact is local privilege escalation with high confidentiality/integrity/availability implications. R...

firefox: thunderbird: Use-after-free in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Signaling component...

PT-2026-1436

Name of the Vulnerable Software and Affected Versions AirVPN Eddie version 2.24.6 Description The software contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root. Recommendations Update to a newer version that contains a fix for this...

Malicious code in shop-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5afad53032ae0acf7c8b481c6f0bd05fc4a1c283de24285d35b19a376cfa1b10 The package shop-state was found to contain malicious code. Source: ossf-package-analysis...

firefox: thunderbird: Use-after-free in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Signaling component...

firefox: thunderbird: Use-after-free in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Signaling component...

firefox: thunderbird: Use-after-free in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Signaling component...

Researcher Wipes White Supremacist Dating Sites, Leaks Data on okstupid.lol

Security researcher in "Martha Root" in Pink Power Ranger deletes white supremacist dating sites live onstage, leaks 8,000 profiles and 100GB of data at Chaos Communication Congress CCC 2025...

firefox: thunderbird: Use-after-free in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Signaling component...

MAL-2026-34 Malicious code in atm_bmw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aca0601b1d8613895ac524d33f93ab92365d464e80eb526e58e2ca919abba129 The package atmbmw was found to contain malicious code. Source: ghsa-malware 20fd437233c7e774bdca9f661a997a94bd0d8373866763c3638f9bc12c588c5e Any...

MAL-2026-32 Malicious code in blobhunter-depconf-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f921f8e8c11a044b483aa7c500c15b42917baa7ef4489b8301c564088fd4b7e3 The package blobhunter-depconf-poc was found to contain malicious code. Source: ghsa-malware...