Malicious Package

Overview @zynkit/jwtbytes is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips...

EUVD-2026-41248

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-11592

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-11592 Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

PT-2026-54614

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

unified-bb-suite

Unified BB Suite — Combined Workflow Two work...

DRUPAL-CONTRIB-2026-068

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the use...

DRUPAL-CONTRIB-2026-067

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution incurring LLM spend and tool side effects or send messages into other...