python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

Malicious code in runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832 The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2026-14116 Malicious code in runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832 The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious Package

Overview epic-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview epic-common-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

Malicious Package

Overview @ai-vertical/ai-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

PT-2026-76890

Name of the Vulnerable Software and Affected Versions docx4j versions prior to 11.5.14 Description PropertyResolver and associated helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX file containing mutually based styles...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100568)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100568 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100126)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100126 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099919)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099919 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbofrm chain-mode implementation...

Malicious Package

Overview kb-ai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview agentgui is a malicious package. This package has been compromised as part of a malicious supply-chain attack linked to North Korean threat actors Contagious Interview campaign / Lazarus APT group. The legitimate package was hijacked, with intact functionality maintained to evade early...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2026-10035 Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...