Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

UBUNTU-CVE-2026-57218

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

CVE-2026-57574

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password TOTP authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If...

MAL-2026-10173 Malicious code in paysafe-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1 The package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an exfil routine that collects os.hostname,...

MAL-2026-10171 Malicious code in paysafe-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2877a8bf5626e24e7e65c02d1ba6d5f27be7d7367079e0e3065f95775e31f7f7 The package presents itself as a Node.js client for the Paysafe REST API but its main entry ships an XOR-obfuscated stealer. When any advertised SDK...

MAL-2026-10168 Malicious code in paysafe-fraud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a596646a3604e01bef558573fc7199a2b9e9cc07ab7edae1b7e445d2e2b860b6 Package advertises itself as the 'Paysafe Fraud Prevention SDK' name paysafe-fraud, repo github.com/paysafe/paysafe-fraud but the exported...

MAL-2026-10167 Malicious code in paysafe-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db76c1b389e2c8d019eda8a0b6f3b8c28193fd3f9de4abe6234bab1e595e619 Package presents itself as a Paysafe Checkout SDK but is a credential-stealing lure. index.js defines a PaysafeClient with fake payments/customers AP...

CVE-2026-15143

A flaw was found in the filetype content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition XSD string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file...

MAL-2026-10144 Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

MAL-2026-10148 Malicious code in polygon-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...

MAL-2026-10147 Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

CVE-2026-55500 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export containing all credentials, API keys, OAuth tokens, and settings and full database import complete overwrite without any authentication requirement beyond the ALWAYSPROTECTED...

CVE-2026-55500

CVE-2026-55500 (9router) exposes a critical flaw in the /api/settings/database endpoint. The GET export returns the entire database, including plaintext API keys, OAuth tokens, and provider credentials, while POST can wipe-and-replace the database with attacker-controlled data. This bypasses auth...

EUVD-2026-42927

A flaw was found in the filetype content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition XSD string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file...

CVE-2026-15143

A flaw was found in the filetype content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition XSD string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file...

CVE-2026-41879

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000...

CVE-2026-15378 Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

A flaw was found in the guardrails-detectors component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery SSRF by submitting a specially crafted XML Schema Definition XSD string. This can lead to unauthorized access to sensitive information, including...

CVE-2026-6440

The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the resetcredential function, which handles the...

CVE-2026-41879 Weak password hashing in R-SOFT DMS

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000...

CVE-2026-41879

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000...