@metamask/kernel-browser-runtime (0.6.0), @metamask/kernel-cli (0.1.0) +5 more potentially affected by CVE-2026-103936 via @libp2p/webrtc (>=6.0.15, <=6.0.25)

@libp2p/webrtc NPM version =6.0.15, =0.6.0-beta.0, =0.1.0-rc.0, =0.1.0 Source cves: CVE-2026-103936 Source advisory: SNYK:JS-LIBP2PWEBRTC-21200904...

@metamask/kernel-browser-runtime (0.6.0), @metamask/kernel-cli (0.1.0) +5 more potentially affected by CVE-2026-103936 via @libp2p/webrtc (>=6.0.15, <=6.0.25)

@libp2p/webrtc NPM version =6.0.15, =0.6.0-beta.0, =0.1.0-rc.0, =0.1.0 Source cves: CVE-2026-103936 Source advisory: MEND:CVE-2026-103936...

CVE-2026-107420

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

CVE-2026-107420 WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

EUVD-2026-96422

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

CVE-2026-107420 WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

CVE-2026-107420

The Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin for WordPress versions

PT-2026-109745

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

CVE-2026-107420: Insufficient Verification of Data Authenticity

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

WordPress Payment Processing via MetaMask for WooCommerce: Input Validation Vulnerability

WordPress payments via MetaMask for WooCommerce versions 1.7.2 and earlier have a vulnerability related to input validation errors. This vulnerability stems from unvalidated bypass attempts...

WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by luffy in WordPress Plugin Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway versions = 1.7.2...

MetaMask Security Incident Prompts Exit of Affected Ethereum Validators

MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors," the software cryptocurrency walle...

PT-2026-103872

@coopernicus01 MetaMask says wallets are fine. It was MetaMask's staking infra validators it runs for Lido, now being exited as a precaution. No action needed for wallet users or stETH holders. Live phish: fake "Consensys" Medium post says re-import your seed CVE-2026-99745. No such CVE...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

Malicious code in wallet-monitor-snap (npm)

Source: amazon-inspector 5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3 wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snapdialog inside MetaMask's trusted UI, tells the user their account has 'unusual...

Malicious code in wallet-monitor-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3 wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snapdialog inside MetaMask's...

MAL-2026-13393 Malicious code in wallet-monitor-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3 wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snapdialog inside MetaMask's...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

MAL-2026-12388 Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

MAL-2026-12387 Malicious code in gekko-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child...