EUVD-2026-55305

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

MAL-2026-13694 Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

CVE-2026-19282 andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection

A weakness has been identified in andreahaku llmmemorymcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llmmemorymcp. Executing a manipulation of the argument hash can lead to command injection...

CVE-2026-19282

The CVE describes a local command-injection risk in the andreahaku llm_memory_mcp project, affecting the auto.capture function in src/autolearn/GitHooksManager.ts. The root cause is a manipulation of the argument hash, enabling injection, with exploitation restricted to local access. No product v...

PoC2Rule

PoC2Rule Agent Automatically convert PoC Proof of Concept f...

Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity

teamcity-CVE-2026-63077-pcap teamcity teamcity-CVE-2026-63077...

CVE-2026-59717

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

EUVD-2026-54571

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3 The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at...

MAL-2026-13626 Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3 The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at...

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle AitM techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211

Technical details about CVE-2026-15211 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-54197

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...

CVE-2026-15208

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...

CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

CVE-2026-47194

CVE-2026-47194 affects Frappe, a full-stack web framework. Before versions 15.108.0 and 16.18.3, the temporary magic login link generation could be influenced by an attacker-controlled Host header, allowing a remote attacker to make emailed login links point to a domain they control and capture t...

CVE-2026-47194 Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...

Malicious code in remote-claude-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c092b787277e3c89fc27a6c01e5360bc0566988cefca0b1a0f9626af9186d0 remote-claude-daemon connects to a hardcoded WebSocket relay at wss://remote-claude-relay.fly.dev and treats inbound messages as commands executed...