Malicious code in mathepy (PyPI)

Source: amazon-inspector 268eeb8db2d704a5b34b2007a25477fdd9f2de3525462f3dd78192aa5d2f95a1 Package metadata advertises mathepy as a 'Module for Quick Calculations', but the package's importable init.py exposes 13 top-level functions askllm, pink, america, iran, momo, dropnull, code, sf, abc, liti,...

Malicious code in ip-rotat (PyPI)

Source: amazon-inspector e85ab2724beee13bb6c2658c5bf5d50069c83619f062d39935226ff1fee1c0a3 On pip install or pip download, setup.py registers overridden install and egginfo cmdclass entries that execute ps -elf to capture the host's process listing and iterate the entire os.environ mapping into a...

Malicious code in dlty (PyPI)

Source: amazon-inspector 494f5fbab24a26771e84ce06eea5303b7d1b9135b505a6d93a01c417603f1902 Importing the dlty package triggers an active data-exfiltration channel from the installer to third-party-controlled infrastructure. dlty/init.py imports dlty.dlt, which defines a class DataLeakTest whose...

Malicious code in chain-validator (PyPI)

--- Credit: OpenSSF source...

Malicious code in bittensor-burn-watch (PyPI)

Source: amazon-inspector 16180f1609731d35398f11dbfcb328826d2e39a7acf42fc256b563512645e6e5 Package advertises itself as a Bittensor subnet burn-rate monitor but bundles a live TELEGRAMBOTTOKEN and TELEGRAMCHATID in bittensorburnwatch/defaults.env that the maintainer's own example file labels as...

CVE-2026-46681

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...

CVE-2026-46681 @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...

ExploitMind

ExploitMind v1.0.0 Full APT Kill-Chain Exploitation Framew...

SUSE CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

dependency-track v5.0.3

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

PT-2026-63055

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A security flaw in the Oracle Agile PLM product of Oracle Supply Chain allows an unauthenticated attacker with network access via HTTP to compromise the system. A successful exploit can lead to a full...

PT-2026-63073

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Install component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to...

PT-2026-62797

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 Description A flaw in the Collaboration History component allows a low privileged attacker with network access via HTTP to compromise the system. Thi...

CVE-2026-61039: Improper Access Control

Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Suppl...

CVE-2026-61266: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite component: Copy Inventory Organization. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

PT-2026-63086

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft component: Purchasing. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

CVE-2026-61185: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Installation. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment...

CVE-2026-61175: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain component: Installation Issues. The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product...

PT-2026-62933

Name of the Vulnerable Software and Affected Versions Oracle Advanced Supply Chain Planning versions 12.2.3 through 12.2.15 Description An issue exists in the Core component of the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite. A high privileged attacker with network...