MAL-2026-4212 Malicious code in polymarket-claude-code (npm)

A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev GitHub actor texsellix, repo texsellix/polymarket-trading-bot within a 2-minute window on 2026-05-20T23:30Z–23:32Z. All packages masquerade as legitimate Polymarket CLOB trading tools while...

MAL-2026-4210 Malicious code in polymarket-auto-trade (npm)

A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev GitHub actor texsellix, repo texsellix/polymarket-trading-bot within a 2-minute window on 2026-05-20T23:30Z–23:32Z. All packages masquerade as legitimate Polymarket CLOB trading tools while...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: kaniko, osv-scanner, snyk-cli, tfsec, gitea, witness, trivy, skaffold, teleport, argo-events, terragrunt, external-secrets-operator, gptscript, grype, argocd-image-updater, kubevela, grafana-alloy, scorecard, bom, rancher-fleet, src-fingerprint, pulumi, gitaly,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: kaniko, osv-scanner, snyk-cli, tfsec, gitea, witness, trivy, skaffold, teleport, argo-events, terragrunt, external-secrets-operator, gptscript, grype, argocd-image-updater, kubevela, grafana-alloy, scorecard, bom, rancher-fleet, src-fingerprint, pulumi, gitaly,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: kaniko, osv-scanner, snyk-cli, tfsec, gitea, witness, trivy, skaffold, teleport, argo-events, terragrunt, external-secrets-operator, gptscript, grype, argocd-image-updater, kubevela, grafana-alloy, scorecard, bom, rancher-fleet, src-fingerprint, pulumi, gitaly,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: kaniko, osv-scanner, snyk-cli, tfsec, gitea, witness, trivy, skaffold, teleport, argo-events, terragrunt, external-secrets-operator, gptscript, grype, argocd-image-updater, kubevela, grafana-alloy, scorecard, bom, rancher-fleet, src-fingerprint, pulumi, gitaly,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: upwind-agent, xeol-fips, kyverno-fips, kubescape, xeol, coder, apko, gomplate-fips, syft, wolfictl, rancher-fleet-fips, rancher-fleet, teleport, grype-fips, grafana-alloy-fips, external-secrets-operator-fips, terragrunt, crossplane-fips, gitaly, jfrog-cli,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: upwind-agent, xeol-fips, kyverno-fips, kubescape, xeol, coder, apko, gomplate-fips, syft, wolfictl, rancher-fleet-fips, rancher-fleet, teleport, grype-fips, grafana-alloy-fips, external-secrets-operator-fips, terragrunt, crossplane-fips, gitaly, jfrog-cli,...

webkitgtk: A maliciously crafted webpage may be able to fingerprint the user

A flaw was found in WebKitGTK. A maliciously crafted web page can cause an authorization issue due to improper state management and may be able to fingerprint the user...

Malicious code in @solarcraft/observix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14c39608a172a624520f309b572b40636dc51563f85fe89dac968712490dd40f The package advertises itself as a zero-dependency colorized logger similar to pino-pretty, but dist/index.js does require'./logger' purely for its...

libssh: Write beyond bounds in binary to base64 conversion functions

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to sshgetfingerprinthash function. In such cases the bintobase64 function can experience an integer overflow leading to a memory under allocation, when that happens it's possibl...

Directory Traversal

Overview cloakbrowser is a Stealth Chromium that passes every bot detection test. Drop-in Playwright replacement with source-level fingerprint patches. Affected versions of this package are vulnerable to Directory Traversal via the fingerprint parameter in the cloakserve process. An attacker can...

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal...

GHSA-MF33-GV72-W2H5 CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal...

PT-2026-41798

Name of the Vulnerable Software and Affected Versions CloakBrowser versions prior to 0.3.28 Description The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker...

Improper Certificate Validation

Nebula is vulnerable to Improper Certificate Validation. The vulnerability is due to ECDSA signature malleability in P256 certificates, which allows an attacker to generate a certificate with a different fingerprint and bypass certificate fingerprint-based blocklist entries...

CVE-2026-44700

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client active role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in...

CVE-2026-44700

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client active role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in...

EUVD-2026-30486

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client active role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in...

CVE-2026-44700

CVE-2026-44700 affects the Elixir WebRTC project (ex_webrtc). Before versions 0.15.1 and 0.16.1, the DTLS fingerprint validation was skipped when the DTLS client acts as the active party during handshake, effectively removing one side of WebRTC’s mutual authentication. This does not by itself ena...