Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AlmaLinux 10 : .NET 9.0 (ALSA-2026:41895)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41895 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

The vulnerability of the microprogramming software of the SIMATIC CN 4100 communication gateway, related to writing outside the buffer, allows a intruder to cause a service failure.

The vulnerability of the MICROprogramming software for the SIMATIC CN 4100 communication gateway is related to writing outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Cisco IOS Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to...

Malicious code in @node-console-log/log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c7960f4102ec63a2f4a105b1fee65edcb12399050dbeb3b94c7c6b6a1fff61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cancelling (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c6ef60911ccd5f41b2e1f332358d78e50a18f4e476f4289734f68ba06768abe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fcogvspgigatanzcydfyvgtjhvxibyau (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d987ceb34687d7e3c37233198705c5db7f3ba49910be418829475c475d20b21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-12942

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

SUSE CVE-2026-40304

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the conditio...

SUSE CVE-2026-40344

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler PutObjectExtractHandler allows any user who knows a valid access key to write...

Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System

Enterprise AI AppSec requires more than powerful models. It requires a system that balances speed, depth, and cost across the software lifecycle...

SUSE CVE-2026-54562

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

JLSEC-2026-966 ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with IPTCTEXT. Versions 7.1.2-15 and 6.9.13-40 contain a patch...

JLSEC-2026-1035 ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versio...

Malwarebytes for Windows, now available on the Microsoft Store

When you’re setting up a new PC or looking for an app you already know, the Microsoft Store is often the easiest place to start. It’s built into Windows and lets you find, install, and update apps in one place. Malwarebytes for Windows is now available there too. Malwarebytes for Windows is still...

EUVD-2026-50501

MCP Ruby SDK: Ruby SSE Session Poisoning...

GHSA-5P9G-J988-PCWV MCP Ruby SDK: Ruby SSE Session Poisoning

Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for...

EUVD-2026-50502

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport...

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A...