Security Evaluation of Quantum Distance-Bounding Protocols Via Semidefinite Programming

Quantum distance-bounding QDB protocols let a verifier check that a prover is both genuine and physically nearby. During a timed fast phase of quantum communication, the verifier measures round-trip times to obtain an upper bound on the prover's distance. For a uniform comparison, we isolate the...

MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

PT-2026-59155

Summary The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs tha...

Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

Malicious code in searchresults (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d5453a0b1576ed8880071cda901607e79f25378700d3f999ab2c9715e00635 [email protected] is a high-version dependency-confusion squat on the generic name 'searchresults'. package.json declares preinstall and...

MAL-2026-7003 Malicious code in searchresults (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d5453a0b1576ed8880071cda901607e79f25378700d3f999ab2c9715e00635 [email protected] is a high-version dependency-confusion squat on the generic name 'searchresults'. package.json declares preinstall and...

CVE-2026-54344

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a...

Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act

The EU Cyber Resilience Act CRA makes a smart bet. It does not demand that products be free of vulnerabilities, but only that manufacturers run a process: assess risk, handle flaws, ship updates. The bet pays off if four things about the world stay true: P1 finding vulnerabilities is slow, skille...

PT-2026-56481

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a...

MAL-2026-7318 Malicious code in mcp-ci-runner-poc (npm)

--- -= Per source details. Do not edit below this line.=-...

5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management

Cloud security posture management CSPM is being redefined as two forces collide: Cloud environments are becoming more interconnected—spanning workloads, identities, data, APIs, and development pipelines—while security teams must reduce risk faster with fewer tools and less time. Frost & Sullivan’...

5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management

Cloud security posture management CSPM is being redefined as two forces collide: Cloud environments are becoming more interconnected—spanning workloads, identities, data, APIs, and development pipelines—while security teams must reduce risk faster with fewer tools and less time. Frost & Sullivan’...

CVE-2026-55697

A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by crafting a malicious repository that declares a configDependency in its pnpm-workspace.yaml file. When a user installs packages from this repository, pnpm improperly treats the declared dependency a...

GHSA-322X-V876-G883 @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

Summary The matchFileSnapshot function in src/assertions/snapshots.ts accepted a filePath parameter with zero validation. When snapshot update mode was active UPDATESNAPSHOTS=1 or setUpdateMode'all', an attacker who controls test input could write arbitrary content to any filesystem path the...

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, eks-distro, azuredisk-csi, argo-cd-fips, azurefile-csi-fips, longhorn-manager-fips, longhorn-share-manager, longhorn-share-manager-fips, longhorn-manager, kubernetes-csi-driver-hostpath, harvester, rancher-system-agent, harvester-fips,...

GitLab CI/CD Unauthorized Access

The vulnerability of the software interface of the CI/CD subsystem of the Git-based software platform for collaborative code development in GitLab EE/CE is related to insufficient protection of registration data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

GitLab Reverse DNS Unauthorized Access

The vulnerability of the software interface of the CI/CD subsystem of the Git-based software platform for collaborative code development on GitLab EE/CE is related to the dependence of critical operations on the reverse DNS solution. Exploiting this vulnerability can allow a malicious actor to ga...

MAL-2026-6698 Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the pipeline.Author process. An attacker can execute unauthorized pipeline steps and exfiltrate CI secrets by setting the commit author name in a GitLab webhook payload to match an entry in the approval list,...