Malware in @yongot/canary-mcp-test-2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @yongot/canary-mcp-test

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reportsconfig permission can inject...

GHSA-23RH-XW42-FQ82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reportsconfig permission can inject...

PYSEC-2026-3973 Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484 We have identified a security incident affecting certain versions of one of our PyPI packages. What happened We have determined that one or more...

Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484We have identified a security incident affecting certain versions of one of our PyPI packages. What happenedWe have determined that one or more...

USN-8748-1 linux-nvidia-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - GFS2 file system; -...

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - GFS2 file system; -...

PYSEC-2026-3914 qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

PYSEC-2026-3916 reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

SummaryThe qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

ROS-20260910-73-0032

The vulnerability of the History Embeddings component in Google Chrome and Microsoft Edge browsers is related to the simultaneous execution using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromis...

BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense

Cyber attacks are increasingly automated, narrowing the time available for human analysts to detect, reason about, and respond to intrusions. Large language models LLMs offer a promising foundation for autonomous cyber defense because they can correlate heterogeneous evidence and reason about...

PT-2026-89680

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...

ROS-20260910-73-0036

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and compromise its integrity through a...

ROS-20260910-73-0029

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity through a specially created HTML page...

ROS-20260910-73-1153

The vulnerability of the Paint component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially created HTML page...

PT-2026-89734

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...

Malware in @auction-fe/ui-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-16108 Malicious code in @auction-fe/reporting-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41fe4ef01818c699bc5c1953702b37cb566a58b0b4769a7ae532b05699b130 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...