EUVD-2026-57737

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

CVE-2026-62882 Microsoft Outlook Spoofing Vulnerability

...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...

Malicious code in beaver-ui-object-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6 On require'beaver-ui-object-card', index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from...

Malicious code in bnpl-blocks-atom-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0 On require'bnpl-blocks-atom-bnpl-feedback', index.js loads bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

Malicious code in statist-browser-typed-client-sme.platform.mobile.voip.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb43194ddda04c3dffa5cb6bea02c8bc6edba8623acf172c5da744b2488e13b0 On require, compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare Workers hosts...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

DEBIAN-CVE-2026-17976

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. Chromium security severity: Low...

CVE-2026-17755

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-17755

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

PT-2026-66140

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description Insufficient policy enforcement in Extensions allows an attacker to bypass navigation restrictions. This occurs when a user is convinced to install a crafted malicious extension...

Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Autonomous multi-agent systems AMAS built on large language models LLMs, such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome extension. Chromium security severity: Medium...

MAL-2026-10933 Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10687 Malicious code in selparsecss-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f [email protected] is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' while the LICENSE-MIT, sour...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

LibreOffice: LibreOffice: Denial of Service via crafted OOXML documents

A flaw was found in LibreOffice. A remote attacker could exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted OOXML Office Open XML document with mismatched encryption salt parameters. This could lead to a denial of service DoS, making the application...