MAL-2026-10838 Malicious code in @gocortexio/npmgremlinbox-mpl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b711dafb2bb4c7dfab16c8144346191d7e09f630cfa91e7dd9e3b9b9960151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10836 Malicious code in @gocortexio/npmgremlinbox-malware-install-execution (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a5a537b1738692165e905b11697bdac7455cccde5bf8b788767642d26c33b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10816 Malicious code in @gocortexio/npmgremlinbox-cpol-1-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2184d51efaa813eba204f724caf876441f354323d358251674a60def88a83e9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10798 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab67244a2c791ff06e830004b8fccdbc75449d2c0b85b15b9fa2e2fa995f676 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10803 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad0f72a8295e2a43e599a9b2afbc64201b6b7ca56c9b4f2161ddc07f3f25120 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10795 Malicious code in @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76e5b6e244c7645a990797de600bbe5b61534485f8037ec0b8b865a50c10b523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10793 Malicious code in @gocortexio/npmgremlinbox-busl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fde0f39d1aa2fb79d17f5582fc5044520af5bbbc864b910954b1476eeb62b6b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10788 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

MAL-2026-10785 Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b9f161ff7fd8e7bf1fd1496277f6839c49d06cb7dd0e6daf772a019fb46b1cd No a static rule matches and no traced malicious behavior were observed in this package version. No credential access, no install/import-time network...

MAL-2026-10863 Malicious code in telebot-bot-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c556b9ded1648a2523210bf518dea35324c749733eabeef3268795351b1b9c On import, telebot-bot-run 0.3 executes two attacker-controlled code paths against the installer's host. First, the top-level module fetches...

PT-2026-61547

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%BizerbaBRAIN2. Starting with BRAIN2 3.09, the setup no longer executes this...

PT-2026-61716

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

PT-2026-61539

Name of the Vulnerable Software and Affected Versions Konnectivity proxy-server affected versions not specified Description A flaw in the configuration of the proxy-server for hosted control planes allows the agent-facing listener to start without the --cluster-ca-cert flag and without token-base...

ALSA-2026:41947 Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Fedora 45 : kronosnet (2026-3e85d87212)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3e85d87212 advisory. Automatic update for kronosnet-1.35-1.fc45. Changelog Mon Jul 20 2026 Fabio M. Di Nitto - 1.35-1 - New upstream release - CVE-2026-15811 LOW:...

Vulnerability of the DOM component: Mozilla Firefox’s navigation feature, which allows attackers to compromise the privacy and integrity of protected information.

Vulnerability of the DOM component: Mozilla Firefox’s navigation mechanism is associated with deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-63941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which...

Medium: tomcat

Issue Overview: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0...

Medium: tomcat9

Issue Overview: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0...

CVE-2024-51311

CVE-2024-51311 affects Tenda TX9 firmware version V22.03.02.05. A stack overflow is reported in the sub_4418CC function of /goform/SetNetControlList. The CVSS 3.1 base score is 9.8 (CRITICAL) with network attack vector, low attack complexity, no user interaction, and impact to confidentiality, in...