CVE-2026-42850

creationtimestamp| type| source ---|---|--- 2026-08-09 18:21:53+00:00| seen| https://vulnerability.circl.lu/bundle/d517fb59-dc35-45a9-8c20-83397659735e...

CVE-2026-54057

creationtimestamp| type| source ---|---|--- 2026-08-09 18:21:53+00:00| seen| https://vulnerability.circl.lu/bundle/d517fb59-dc35-45a9-8c20-83397659735e...

CVE-2026-54055

creationtimestamp| type| source ---|---|--- 2026-08-09 18:21:53+00:00| seen| https://vulnerability.circl.lu/bundle/d517fb59-dc35-45a9-8c20-83397659735e...

Debian dla-4726 : ca-certificates - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4726 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4726-1 [email protected]...

MAL-2026-13423 Malicious code in fetchrtds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef On npm install, the package's postinstall script reads a config URL defaulting to https://slimopump.vercel.app/config/clob-math.json, fetches a.tgz...

Malicious code in fetchrtds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef On npm install, the package's postinstall script reads a config URL defaulting to https://slimopump.vercel.app/config/clob-math.json, fetches a.tgz...

MAL-2026-12893 Malicious code in bnpl-blocks-atom-bnpl-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e88e9faf590414055ba1b7b48bdaa51df5e33735b9dd526e5d8d0650eceae7 On require of the package's main entry, init.js fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames assembled by joining...

Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

MAL-2026-13106 Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

MAL-2026-12664 Malicious code in constructor-blocks-renderer-mailings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b9c524160eaa76ac80781bfc28ed9e3f3b54295360d8f21989724a1dd34d34 On module load, index.js requires./bridge.js, which reassembles hardcoded C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in ts-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8 The package's postinstall script scripts/install-check.cjs reads a bundle URL from https://polymarket-clob-service.vercel.app/config/clob-math.json,...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-12376 Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CLSA-2026-1784856186 TuxCare security update for webpack-bundle-analyzer (1 CVE)

TuxCare rebuilt webpack-bundle-analyzer to address 1 CVE. Fixed in 2.13.1-tuxcare.1...

PT-2026-75686

TuxCare rebuilt webpack-bundle-analyzer to address 1 CVE. Fixed in 2.13.1-tuxcare.1...

AZL-94425 CVE-2026-54787 affecting package gh for versions less than 2.97.0-1

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

DEBIAN-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...