MSC-2025-7952

prebid was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s account was access...

MSC-2025-7951

prebid was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s account was access...

MSC-2025-7949

duckdb was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s account was access...

MSC-2025-7890

prebid-universal-creative was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s...

MAI-2024-0014

This vulnerability in large language models LLMs enables attackers to extract unsafe or unethical responses by employing a sequence of semantically connected multi-turn prompts. Known as the "Chain of Attack" CoA, this method exploits the model's contextual comprehension and adaptive response...

@airalogy/airalogy-engine (>=0.0.1, <=0.0.6) potentially affected by CVE-2026-46703 via @boxlite-ai/boxlite (0.8.2)

@boxlite-ai/boxlite NPM version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on @boxlite-ai/boxlite and may be impacted: - @airalogy/airalogy-engine =0.0.1, =0.0.6 Source cves: CVE-2026-46703 Source advisory: SNYK:JS-BOXLITEAIBOXLITE-16787373...

A Red Teaming Framework for Evaluating Robustness of AI-Enabled Security Orchestration, Automation, and Response Systems

AI-enabled Security Orchestration, Automation, and Response SOAR systems increasingly employ autonomous agents for cyber defense, yet their resilience to adaptive adversaries is underexplored. We introduce an autonomous red teaming framework that integrates large language models LLMs with...

MSC-2025-5542

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.7...

MSC-2025-5541

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.10...

MSC-2025-5538

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.6...

MSC-2025-5537

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.8...

MSC-2025-5535

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.9...

MSC-2025-5533

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.3.15...

MSC-2025-5532

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.12...

MSC-2025-5531

This package version was compromised through a supply chain attack campaign. It includes a Remote Access Trojan that connects back to a C2 server to receive commands to execute. We recommend reverting to the last safe version 0.2.12...

Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence

Cybersecurity researchers have disclosed a set of four security flaws in OpenClaw that could be chained to achieve data theft, privilege escalation, and persistence. The vulnerabilities, collectively dubbed Claw Chain by Cyera, can permit an attacker to establish a foothold, expose sensitive data...

TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates

OpenAI has disclosed that two of its employee devices in its corporate environment were impacted via the Mini Shai-Hulud supply chain attack on TanStack, but noted that no user data, production systems, or intellectual property were compromised or modified in an unauthorized manner. "Upon...

WS-2023-0305

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. We now give each path building operation...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434, distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434, distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the...