Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

MAL-2026-15914 Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-15913 Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-15903 Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

Malicious code in tailwind-container-queries (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...

sonar v0.4.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

EUVD-2026-70785

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

PT-2026-86161

Name of the Vulnerable Software and Affected Versions undici versions 6.7.0 through 6.28.0 undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The WebSocket client crashes the Node.js process during the opening handshake if a server responds with a subprotocol th...

PT-2026-85693

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access...

CVE-2026-81665: Heap-based Buffer Overflow

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

Linux Distros Unpatched Vulnerability : CVE-2026-85014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake...

Linux Distros Unpatched Vulnerability : CVE-2026-85052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory...

CVE-2026-75429: Improper Authentication

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

Linux Distros Unpatched Vulnerability : CVE-2026-85048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary co...

CVE-2026-80824: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...

PT-2026-85807

Name of the Vulnerable Software and Affected Versions undici versions 6.25.0 through 6.28.0 undici versions 7.28.0 through 7.29.0 undici versions 8.1.0 through 8.10.1 Description A flaw in the WebSocket client's permessage-deflate size-limit cleanup removes all listeners from the internal zlib...

PT-2026-85806

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During ...

PT-2026-85702

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the usbdev release function within the usbfs component. The function drops its reference to the usb device structure before draining the list of complete...