MAL-2026-10933 Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

PT-2026-61663

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.41 Description Authenticated users enrolled in a course, such as students, teachers, or DRH, can achieve remote code execution. The issue exists in the 'main/inc/ajax/lang.ajax.php' endpoint, which is only...

PT-2026-61662

Name of the Vulnerable Software and Affected Versions Mettle SendPortal versions prior to 3.0.2 Description A stored cross-site scripting XSS issue exists in the template management functionality. The application does not properly sanitize user-supplied input in the content parameter of the...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

CVE-2026-26483

Summary: CVE-2026-26483 affects Mettle SendPortal 3.0.1 and earlier. A stored cross-site scripting (XSS) vulnerability exists in the template management functionality where input in the content parameter of the /templates endpoint is not properly sanitized, enabling an attacker to persistently in...

PT-2026-61666

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.219 Description An issue exists in the open tracking endpoint GET /thread/read/conversation id/thread id that allows unauthenticated attackers to enumerate valid conversation and thread IDs. Additionally, this...

MAL-2026-10944 Malicious code in zer0onetencent (npm)

The zer0onetencent package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

MAL-2026-10945 Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Linux Distros Unpatched Vulnerability : CVE-2026-63928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoi...

WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE

Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

Exploit for CVE-2026-63030

wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...

CVE-2026-63928

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63899

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size...

CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increas...

CVE-2026-63957

The CVE-2026-63957 issue affects the Linux kernel USB serial safe_serial implementation. The vulnerability is a memory corruption risk when using a small endpoint, arising from an inadequately sized bulk-out buffer; in safe mode, a malicious device reporting a smaller size could lead to user-cont...

CVE-2026-63956

The CVE-2026-63956 entry describes a Linux kernel vulnerability in USB serial for Cypress M8 devices. The issue occurs when the interrupt-out endpoint max packet size is smaller than eight bytes, enabling potential user-controlled slab corruption or NULL-pointer dereference if a malicious device ...

EUVD-2026-45729

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...