Malicious code in @aerodrome-finance/contracts (npm)

@aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the code...

MAL-2026-13739 Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...

PT-2026-70921

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists within the Extensions component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. An...

PT-2026-70126

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...

PT-2026-70920

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists in the TabStrip component of Google Chrome on Mac. This occurs when a remote attacker, having already compromised the renderer process, uses a specially...

PT-2026-70357

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX CODE ONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'child...

PT-2026-70832

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

PT-2026-70200

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENV VAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

PT-2026-70923

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use after free issue in Blink allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory corruption flaw...

PT-2026-70844

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

MAL-2026-13735 Malicious code in @aerodrome-finance/slipstream (npm)

@aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liquidity AMM. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall ru...

AZL-95616 CVE-2026-63622 affecting package libvirt 10.10.0-2

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Exploit for Protection Mechanism Failure in Microsoft

cve-id Donate Support the maintenance of this project wit...

Astra Linux – Vulnerability in Firefox and Thunderbird

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox

Sandbox escape due to a use-after-free in the Graphics:Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFs in Google Chrome before version 146.0.7680.178 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox and Thunderbird

Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Compositing in Google Chrome before version 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in Forms in Google Chrome before version 147.0.7727.101 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...