Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

PYSEC-2026-2888 Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

CVE-2026-59207

creationtimestamp| type| source ---|---|--- 2026-07-09 16:10:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7zibfybn25...

CVE-2026-59208

creationtimestamp| type| source ---|---|--- 2026-07-09 16:03:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7z3sn6kq2i 2026-07-15 15:22:07+00:00| seen| https://bsky.app/profile/hn100.bsky.social/post/3mqozlgli3q2t 2026-07-15 15:27:26+00:00| seen|...

CVE-2017-2845

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7k7ms5iz2n...

CVE-2026-2342

creationtimestamp| type| source ---|---|--- 2026-07-09 09:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7dvjy7wm2w...

CVE-2026-15137

creationtimestamp| type| source ---|---|--- 2026-07-09 03:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qa72g7o2k...

CVE-2026-15112

creationtimestamp| type| source ---|---|--- 2026-07-09 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116887429378642543 2026-07-09 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq6icwy3iv23 2026-07-09 04:45:15+00:00| seen|...

EUVD-2026-42486

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

Malicious code in testis-pack (npm)

The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...

CVE-2026-15115

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-8651

creationtimestamp| type| source ---|---|--- 2026-07-08 22:22:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65sngqbm2i...

CVE-2026-52200

An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk...

CVE-2026-59731

creationtimestamp| type| source ---|---|--- 2026-07-08 21:27:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq62qs7m6k26 2026-07-20 22:35:02+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv...

CVE-2018-9135

creationtimestamp| type| source ---|---|--- 2026-07-08 21:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5zlwiyxb2k...

CVE-2026-0283

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:33+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soz67xf2e 2026-07-09 04:46:20+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:54:24+00:00| seen...

CVE-2026-0285

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:28+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5souktcl2c 2026-07-09 04:46:25+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:41:19+00:00| seen...

MAL-2026-7016 Malicious code in @vraksha/gh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12 On npm install, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload,...

CVE-2026-58656

creationtimestamp| type| source ---|---|--- 2026-07-08 16:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ks3mgr32k...

CVE-2026-49147

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a...