Malicious code in forge-jsxy (npm)

forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and carries an identical fake description 'Node.js integration layer for Autodesk Forge' to impersonate a legitimate Autodesk Forge SDK. The package is a fully-formed RAT deploy...

AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use

Modern AI agents execute real-world side effects through tool calls such as file operations, shell commands, HTTP requests, and database queries. A single unsafe action, including accidental deletion, credential exposure, or data exfiltration, can cause irreversible harm. Existing defenses are...

ALSA-2026:14200 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282...

RHEL 9 : git-lfs (RHSA-2026:14200)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:14200 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

RockyLinux 10 : golang (RLSA-2026:10217)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10217 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:10704)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10704 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-42334 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-42334 Source advisory: OSV:GHSA-WPG9-53FQ-2R8H...

CVE-2026-34459

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request...

@chrysb/alphaclaw (>=0.9.1-beta.0, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43572 via openclaw (>=2026.4.10, <=2026.4.12)

openclaw NPM version =2026.4.10, =0.9.1-beta.0, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43572 Source advisory: SNYK:JS-OPENCLAW-16420268...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: SNYK:JS-FASTURI-16642394...

Exploit for Double Free in Apache Http_Server

CVE-2026-23918-test This repository contains a Proof of Concep...

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCall to likely target ethnic Koreans residing in China. While prior versions of the backdoor hav...

SUSE CVE-2026-41174

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15978 more potentially affected by CVE-2026-42042 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42042 Source advisory: OSV:GHSA-XX6V-RP6X-Q39C...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15978 more potentially affected by CVE-2025-62718 +1 more via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2025-62718, CVE-2026-42043 Source advisory: OSV:GHSA-PMWG-CVHR-8VH7...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16038 more potentially affected by CVE-2026-42044 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42044 Source advisory: OSV:GHSA-3W6X-2G7M-8V23...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16038 more potentially affected by CVE-2026-42264 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42264 Source advisory: SNYK:JS-AXIOS-16417750...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16038 more potentially affected by CVE-2026-42264 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42264 Source advisory: OSV:GHSA-Q8QP-CVCW-X6JJ...

axios: Axios: Remote Code Execution via Prototype Pollution escalation

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: SNYK:JS-FASTURI-16642399...