Malicious code in envprovision (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6 envprovision 1.4.0 presents itself as an environment-diagnostics helper but its public check/sync API, on Windows, fetches a JSON manifest from a...

MAL-2026-14389 Malicious code in envprovision (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6 envprovision 1.4.0 presents itself as an environment-diagnostics helper but its public check/sync API, on Windows, fetches a JSON manifest from a...

EUVD-2026-63198

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information...

Malicious code in blocks-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fc5edc76efb69b1da38c78d3ee103dd217098b5c8267a48d360a40086c84a72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

EUVD-2026-57729

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

CVE-2026-72506

CVE-2026-72506 affects VoiceTra by the National Institute of Information and Communications Technology (NICT). The issue is an incorrectly specified destination in a communication channel, which may redirect users to a server or service controlled by an attacker. Consequences described include po...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

Malicious code in vlbhvgovbbhfab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5b717c270d7c4f965a421923d78bff7a86b044999f557386a258c7050768620 Package [email protected] contains 2 files. No install-time lifecycle scripts, exfiltration primitives, hardcoded network destinations,...

Malicious code in spoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c32e6b328bf731b6269e720e0fda2dec5264452ef04d406fde5296413424525 Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator source files...

Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

EUVD-2026-54715

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

Canadian Man Pleads Guilty in Snowflake Extortions

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Connor Riley Moucka , of Kitchener, Ontario, also...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2026-53287

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-55739

CVE-2026-55739 (Crater) : The vulnerability arises from a missing tenant-ownership check in CustomerPolicy where view/update/delete do not verify company ownership, plus unscoped route-model lookups and bulk deletion (self::find($id)) that ignore company filters. As a result, any authenticated us...

CVE-2026-55739 Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...