Command Injection

aws-cdk-lib is vulnerable to Command Injection. The vulnerability is due to improper sanitization of user-controlled bundling properties in the NodejsFunction local bundling pipeline, which allows an attacker to inject shell metacharacters and execute arbitrary commands on the host running the CD...

PT-2026-49753

Name of the Vulnerable Software and Affected Versions DNG SDK versions prior to 1.7.1 2536 Description An out-of-bounds read issue allows for the disclosure of sensitive memory. This occurs when the software reads data outside the intended boundary of a buffer, potentially exposing confidential...

PT-2026-54545

Уязвимость программного средства чтения и записи файлов DNG Adobe DNG Software Development Kit SDK связана с переполнением буфера в динамической памяти. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

PT-2026-54546

Уязвимость программного средства чтения и записи файлов DNG Adobe DNG Software Development Kit SDK связана с чтением за пределами допустимого диапазона в памяти. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию...

EUVD-2026-36963

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

CVE-2026-39534

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

Malicious code in @wacrot/infra-data-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1568dfa61d19a63f6837c4a8c9b5d728401d0f34c87ce3550af594c141a94ac1 On any require or import of @wacrot/infra-data-kit, src/index.js invokes addSupport at module top level, which spawns a detached bash -c 'curl -fsSL...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.246.0...

CVE-2026-39534 WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

CVE-2026-39534

WP Directory Kit plugin for WordPress, versions

CVE-2026-39534 WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

Malicious code in ckanext-dms (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5bce6d55a65fbab98cd93d6109b563f49e9557b542a8b9c2fd68e25755b7089e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-39534: Missing Authorization

Unauthenticated Broken Access Control in WP Directory Kit = 1.5.0 versions...

Malicious code in theta-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b0737ff5b0b0768e2314b014529b80609632a38dfdc3a9ad6cfd6ab1da9039 package.json declares postinstall: node dist/index.js, and dist/index.js executes Model.resetor at module top level — meaning both npm install...

MAL-2026-5706 Malicious code in theta-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b0737ff5b0b0768e2314b014529b80609632a38dfdc3a9ad6cfd6ab1da9039 package.json declares postinstall: node dist/index.js, and dist/index.js executes Model.resetor at module top level — meaning both npm install...

Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing

Google on Friday said it's pursuing legal action against a Chinese cybercrime network, accusing it of using its Gemini artificial intelligence AI agent to send phishing text messages targeting Americans. The network is said to be behind the development and management of a phishing-as-a-service...

.NET 8.0 security update

An update is available for dotnet8.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

p11-kit security update

0.26.2-1 - Rebase to 0.26.2 Resolves: RHEL-147825 0.26.1-1 - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 0.25.10-1 - Update to new upstream release 0.25.10 Resolves: RHEL-115453...

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories

It's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into leaking real...

Malicious Package

Overview tailwindcss-animates-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...