MAL-2026-15888 Malicious code in indexed-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcf3d23eb09d4a5d5736b43c78f6b140e79d23c0ac3488e84f3f1633c1ae578 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in element-guci-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43ee355ab038085d87ed11e81acc53a50163f14b617d54b7e9b9c31e800900a Package is published as an element-ui utility library element-guci-util, description '元素-ui 常用工具函数集合' but its main entrypoint contains no utility...

Malicious code in google-internal-cloud-audit-security-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62a38a595d0fcf5e869dc2cdd939d476de1fbd24253eb6afd383c08c959dfc34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15833 Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15838 Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Insufficiently Protected Credentials in Wazuh

Automated research artifact — not the upstream project...

CVE-2026-75033: Authorization Bypass Through User-Controlled Key

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

EUVD-2026-62535

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter CVE-2026-44738 bypass...

EUVD-2026-70262

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

trufflehog v3.97.2

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

EUVD-2026-42744

Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db...

Malicious code in is-generator-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93931fecef2da94abf1de73e282da2c510715512d61bfe8afd1197925f4b6e08 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in daisypick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9bd46c99a0d58d9ded0faca080e42efa9015c9bd213c46292e82644117d53ae The package presents itself as a Tailwind CSS color/service-worker helper, but the daisypick/plugin export reads a URL from...

MAL-2026-15836 Malicious code in eyiouss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bedee2fc7da5658522543d3fe376d8fbf1d3bc8386eb8f53df3ee080830b250 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-84859

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS VM READ permission to read the memory space of UpSignOn.exe...

MAL-2026-15830 Malicious code in @viertechjs/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a35c7b86ec1a4d9922b7c74dbdab948b868f8cf43a8f5c01053692e6a85803 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

GHSA-VX52-2968-3VC6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Summary pnpm expands $VAR environment placeholders in the httpProxy / httpsProxy / noProxy settings read from a project's pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs pnpm install in can route all install...