Malicious code in classlink-xx8vtk2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee0c9c321dee714b749d6271bd1457ffe6b8012b0aac1f0040fd42948bb8c25e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-232piklt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02bb3849498cda4f72351e29daef99f75364db79dd4682f69afcbea136bba4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15431 Malicious code in secure-test-browser-tiig2hex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4829a189343d6bdff7151295c60b6ff0bbd33abc107a477f833162d33fde3c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-1pe78gsn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f28ffec21f3e045c397f63967f734b8033f03776e398cfc23d0a694755990ca2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share...

SUSE-SU-2026:23364-1 Security update for c-ares

This update for c-ares fixes the following issues: Update to c-ares 1.34.8. - CVE-2025-31498: use-after-free in readanswers when processanswer may re-enqueue a query bsc1240955. - CVE-2025-62408: use-after-free due to connection being cleaned up after error bsc1254738. - CVE-2026-33630: remotely...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ZBT, each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTE...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

PT-2026-82873

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-55064: Missing Authorization

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

PT-2026-83284

Name of the Vulnerable Software and Affected Versions Hermes Agent versions 0.18.2 through 0.18.x Description A supply chain issue exists in the bundled MCP catalog. A remote attacker can execute arbitrary code by compromising a third-party upstream repository that is referenced via a mutable...

CVE-2026-82021: Download of Code Without Integrity Check

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-80652: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-core-10.1.57, netty-codec-http2-4.2.15.Final.jar, mlflow-3.11.1-py3-none-any.whl, gitpython-3.1.49-py3-none-any.whl, docling-2.91.0-py3-none-any.whl, transformers-5.6.2-py3-none-any.whl, ip-address-10.2.0.tgz, bcutil-jdk18on-1.84.jar,...

CVE-2026-81690

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...