MAL-2026-11178 Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in @peptide-unit/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...

CVE-2026-9177

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

USN-8623-1: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Arm Firmware Framework for ARMv8-AFFA; CVE-2026-53354, CVE-2026-64520...

CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

EUVD-2026-50331

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-14354

CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, when a local privileged attacker leverages weaknesses in the handling and protection of stored...

Malicious code in zer0code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f11a39a2be94308e553081d26ba71cf416858053c84e52674666ba6f4acbf0f Package ships Python files under skills/pentesting.py and tools/security/exploit.py that reference ping commands and shell-spawning primitives...

CVE-2026-64283

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. An integer overflow vulnerability exists in the guestmemfd functionality when binding memory slots. A malicious guest operating system could exploit this by providing crafted offset and size values, leading to...

CVE-2026-63242

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...

EUVD-2026-50129

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

MAL-2026-11181 Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

MAL-2026-11161 Malicious code in @joyfill/layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...

MAL-2026-11160 Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90bed9c7a2d887bec8559ce5eb8d86d3af53b17bfcc685a0469c2f1727979f78 No a static rule matches and no traced behavioral findings were produced for @joyfill/[email protected]. The package artifact does no...

MAL-2026-11168 Malicious code in postcss-motion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4534713b2409f1fe5588befb885030edc2eafddf215d1103e70f9024c64cbc35 Package is advertised as a small PostCSS plugin that injects CSS variables and adds -webkit- prefixes, but its main index.js is a 164 KB single-file...

MAL-2026-11164 Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improperly Implemented Security Check for Standard

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard through the secure-client-uris client policy executor in t...