a1 (>=1.0.1, <=1.0.2), apfsds-protocol (>=0.1.0, <=0.4.0) +118 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.2.24, =0.2.27 and more Source cves: unkno...

a1 (>=1.0.1, <=1.0.2), apfsds-protocol (>=0.1.0, <=0.4.0) +118 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.2.24, =0.2.27 and more Source cves: unkno...

@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +80 more potentially affected by CVE-2026-45364 via better-auth (>=1.0.0, <=1.4.16)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: CVE-2026-45364 Source advisory: SNYK:JS-BETTERAUTH-16722787...

EUVD-2026-28942

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directry if the victim uses an attacker-supplied .i64 file...

Trust Me, Import This: Dependency Steering Attacks Via Malicious Agent Skills

LLM-powered coding agents increasingly make software supply chain decisions. They generate imports, recommend packages, and write installation commands. Prior work showed that these systems can hallucinate non-existent package names, which attackers may register as malicious packages. In this...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 prior to 9.3sp2 do not block Clang dependency-file generation, enabling argument-injection via attacker-supplied .i64 files to place code into a plugins directory. Root cause: missing validation in dependency-file generation. Impact: local attacker could achieve code ...

MAL-2026-3406 Malicious code in ggfmttygl-new (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2098233a75602dd1779f720f566420f4a88ec77694b206e7858323b5aeea38d5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...

Malicious code in ggfmttygl-new (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2098233a75602dd1779f720f566420f4a88ec77694b206e7858323b5aeea38d5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...

MAL-2026-3405 Malicious code in ggfmttygl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e741cc1df48cc526ad3a27ac702f5dea403723557b4a485f84847340310d66e5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...

Malicious code in ggfmttygl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e741cc1df48cc526ad3a27ac702f5dea403723557b4a485f84847340310d66e5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +605 more potentially affected by CVE-2026-44458 via hono (>=4.3.2, <=4.12.17)

hono NPM version =4.3.2, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.16 and more Source cves: CVE-2026-44458 Source advisory: SNYK:JS-HONO-16624528...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +612 more potentially affected by CVE-2026-44459 via hono (>=4.0.0, <=4.12.17)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.16 and more Source cves: CVE-2026-44459 Source advisory: OSV:GHSA-HM8Q-7F3Q-5F36...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +890 more potentially affected by CVE-2026-44459 via hono (>=1.6.4, <=4.12.17)

hono NPM version =1.6.4, =0.1.8-fix.3, =0.0.2, =0.3.1, =5.0.0, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.6 and more Source cves: CVE-2026-44459 Source advisory: SNYK:JS-HONO-16624529...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.0 Source cves: CVE-2026-44966 Source...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.0 Source cves: CVE-2026-44966 Source...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +612 more potentially affected by CVE-2026-44457 via hono (>=4.0.0, <=4.12.17)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.16 and more Source cves: CVE-2026-44457 Source advisory: OSV:GHSA-P77W-8QQV-26RM...