Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview mistralai is a Mistral Python Client Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33572 more potentially affected by CVE-2026-45736 via ws (>=8.0.0, <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JS-WS-16722635...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Exploit for CVE-2026-8161

CVE-2026-8161 Proof of concept of CVE-2026-8161 Multiparty...

@abiswas97/postgres-mcp (2.0.0), @adlanarifzr/mikro-orm-migrations (>=7.0.5-next.0, <=7.0.9) +700 more potentially affected by CVE-2026-32763 +1 more via kysely (>=0.26.3, <=0.28.16)

kysely NPM version =0.26.3, =7.0.5-next.0, =7.0.5-next.0, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.78 and more Source cves: CVE-2026-32763, CVE-2026-44635 Source advisory: SNYK:JS-KYSELY-16642092...

@abiswas97/postgres-mcp (2.0.0), @adlanarifzr/mikro-orm-migrations (>=7.0.5-next.0, <=7.0.9) +700 more potentially affected by CVE-2026-44635 via kysely (>=0.26.3, <=0.28.16)

kysely NPM version =0.26.3, =7.0.5-next.0, =7.0.5-next.0, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.78 and more Source cves: CVE-2026-44635 Source advisory: OSV:GHSA-PV5W-4P9Q-P3V2...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @airp/validate-cli (>=1.1.0, <=1.1.3) +173 more potentially affected by CVE-2026-41159 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =1.1.0, =0.0.3, =0.7.9, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.1.0, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.4.0 - @fgbg/mdocs 1.2.0 and more Source cves: CVE-2026-41159 Source advisory: SNYK:JS-MERMAID-16642055...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @airp/validate-cli (>=1.1.0, <=1.1.3) +173 more potentially affected by CVE-2026-41150 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =1.1.0, =0.0.3, =0.7.9, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.1.0, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.4.0 - @fgbg/mdocs 1.2.0 and more Source cves: CVE-2026-41150 Source advisory: OSV:GHSA-6M6C-36F7-FHXH...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +950 more potentially affected by CVE-2026-41149 via mermaid (>=0.2.16, <=10.9.5)

mermaid NPM version =0.2.16, =1.0.0, =0.18.0-beta.0, =0.3.0, =0.1.0, =0.1.0-a0, =0.17.0-alkemio-1, =0.4.0, =0.0.18, =1.0.0, =3.130.1, =1.19.0, =1.50.0 and more Source cves: CVE-2026-41149 Source advisory: SNYK:JS-MERMAID-16642050...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @airp/validate-cli (>=1.1.0, <=1.1.3) +173 more potentially affected by CVE-2026-41148 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =1.1.0, =0.0.3, =0.7.9, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.1.0, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.4.0 - @fgbg/mdocs 1.2.0 and more Source cves: CVE-2026-41148 Source advisory: SNYK:JS-MERMAID-16642044...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...