4961 matches found
Malicious code in @antv/gl-matrix (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4019 Malicious code in @antv/gl-matrix (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
matrix-appservice-irc (>=0.27.0-rc1, <=0.30.0-rc1) potentially affected by unknown CVE via matrix-org-irc (>=1.0.0-alpha4, <=1.1.1)
matrix-org-irc NPM version =1.0.0-alpha4, =0.27.0-rc1, =0.30.0-rc1 Source cves: unknown CVE Source advisory: MEND:WS-2022-0128...
Improper Check for Unusual or Exceptional Conditions
Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the pagination process for federated rooms. An attacker can cause clients to fail to display room...
raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2026-45076 via matrix-synapse (0.33.9)
matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2026-45076 Source advisory: OSV:GHSA-6QF2-7X63-MM6V...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45076 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45076 Source advisory: SNYK:PYTHON-MATRIXSYNAPSE-16726233...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45076 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45076 Source advisory: GHSA-6QF2-7X63-MM6V...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45076 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45076 Source advisory: OSV:GHSA-6QF2-7X63-MM6V...
Asymmetric Resource Consumption (Amplification)
Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification through the handling of authenticated user requests. An attacker can exhaust CPU resources and cause service...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45078 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45078 Source advisory: GHSA-8Q93-326V-3M7G...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45078 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45078 Source advisory: SNYK:PYTHON-MATRIXSYNAPSE-16726260...
matrix-synapse-testutils (>=1.65.0.0, <=1.96.1.0) potentially affected by CVE-2026-45078 via matrix-synapse (>=1.65.0, <=1.96.1)
matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.96.1.0 Source cves: CVE-2026-45078 Source advisory: OSV:GHSA-8Q93-326V-3M7G...
raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2026-45078 via matrix-synapse (0.33.9)
matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2026-45078 Source advisory: OSV:GHSA-8Q93-326V-3M7G...
Exploiting LLM Agent Supply Chains Via Payload-Less Skills
Autonomous agents powered by Large Language Models LLMs acquire external functionalities through third-party skills available in open marketplaces. Adopting these integrations broadens the potential attack surface, prompting a need for systematic security evaluation. Current auditing mechanisms a...
EUVD-2026-29148
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...
CVE-2026-45003
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...
CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...
CVE-2026-45003
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...
CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...
CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files...