Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101986 advisory. In the Linux kernel, the following vulnerability has been resolved: viawdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses...

Important: python-urwid

Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

gitea -- Multiple vulnerabilities

Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...

MAL-2026-13723 Malicious code in godot-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4 lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require'd reachable via lang/loader.js and test.js. The...

Malicious code in chai-jsonss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67 On import, index.js invokes postCallers which resolves a base64-encoded URL stored in lib/const.js decoding to https://1uznbx.s.gy/7xdQmt, GETs the...

Exploit for CVE-2026-64638

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth XSS → RCE e...

MAL-2026-13656 Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

CVE-2026-20337

creationtimestamp| type| source ---|---|--- 2026-08-07 17:50:55+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117055491493877536 2026-08-08 14:02:58+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mslae2k27x2n 2026-08-08 14:03:05+00:00| seen|...

Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

MAL-2026-12542 Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-12634 Malicious code in claims-payout-offer-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e5ae73b4b2f79e2790e4c9f503a3f469166c8d5587f7e84ac6a09022d1617f On require of the package, index.js unconditionally loads vendor.js, which selects an OS/arch-specific payload path and fetches an opaque binary over...

MAL-2026-12647 Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...

MAL-2026-12658 Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

Malicious code in devplatform-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts...

MAL-2026-12746 Malicious code in devplatform-rest-resources-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from...

MAL-2026-12355 Malicious code in com.db.dbk.ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c74649b28994f970d4972ffb8708378b355186eb729bf2e4c45d6acd16346e5d [email protected] is a version-inflated package published to the public npm registry under a scope that resembles an internal namespace. Its...

Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...