MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

SUSE CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

PT-2026-68011

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description The Git deployer component contains an OS Command Injection flaw. The pullRepo function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec to run a shell command that interpolate...

CVE-2026-70375: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

Photon OS 5.0: Git PHSA-2025-5.0-91-0463

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0463. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Git PHSA-2025-5.0-91-0555

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0555. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-67623: Inclusion of Functionality from Untrusted Control Sphere

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

PT-2026-68132

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description An operator-precedence bug exists in the cv.url validator within esphome/config validation.py. Due to the and operator binding tighter than or, any file: URI passes validation regardless of th...

PT-2026-68171

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.23.3 Description A remote code execution issue exists where attackers can execute arbitrary commands by embedding a malicious core.fsmonitor hook within a repository's .git/config file. This is triggered when t...

GitPython Arbitrary Command Execution File Overwrite

The vulnerabilities of the functions Repo.archive, git.lsremote, Repo.itercommits, and Repo.blame in the GitPython library for interacting with Git repositories are related to the lack of data cleaning at the control level. Exploiting these vulnerabilities could allow an attacker to execute...

go-git Countable Loss DoS

The vulnerability of the go-git library is related to a countable amount of significance loss. Exploiting this vulnerability can allow an attacker to cause a service failure by using a specially created malicious .idx file...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Photon OS 5.0: Git PHSA-2024-5.0-91-0271

An update of the git package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0271. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

go-git Unvalidated Array Indexing

The vulnerability of the go-git library is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the accessibility of the protected information...

ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-15307 via django (4.0.0rc1)

django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-15307 Source...

Malicious code in @deliveroo/reevent (npm)

npm/@deliveroo/reevent is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11983 Malicious code in qlik-modifiers (npm)

npm/qlik-modifiers is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...

Malicious code in hamus.js (npm)

npm/hamus.js version 0.4.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

Malicious code in @servicetitan/titan-chatbot-ui-anvil2 (npm)

npm/@servicetitan/titan-chatbot-ui-anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

MAL-2026-11629 Malicious code in @onereach/si-alert (npm)

npm/@onereach/si-alert is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...