@absmartly/mcp (>=1.1.0, <=1.2.4), @agishub/mcp (>=2.1.0, <=3.0.1) +118 more potentially affected by unknown CVE via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =1.1.0, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =0.1.0, =1.0.1, =1.0.27 - @famma/mcp-auth 0.0.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-AGENTS-15282793...

@jamietanna/renovate-graph (0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by unknown CVE via renovate (>=42.92.4, <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph 0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves: unknown CVE...

CVE-2026-26208

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allo...

CVE-2026-26208

CVE-2026-26208 affects ADB Explorer (Windows). It is vulnerable to insecure deserialization via JSON settings file deserialization: the app deserializes App.txt with Json.NET in which TypeNameHandling is set to Objects, enabling a crafted JSON file (for example containing an ObjectDataProvider ga...

Malware in sinon-web3-chain

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Malicious Package

Overview sinon-web3-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-896 Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

Several state-sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea, and Russia have trained their sights on the defense industrial base DIB sector, according to findings from Google Threat Intelligence Group GTIG. The tech giant's threat intelligence division...

Authentication Bypass

Apache Shiro is vulnerable to Authentication Bypass. The vulnerability is due to inconsistent case handling between Shiro’s filter chain matching and the underlying case-insensitive filesystem, where filter rules may be defined only for lower-case paths while the filesystem resolves file names...

OESA-2026-1347 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious...

npm’s Update to Harden Their Supply Chain, and Points to Consider

In December 2025, in response to the Sha1-Hulud incident, npm completed a major authentication overhaul intended to reduce supply-chain attacks. While the overhaul is a solid step forward, the changes don’t make npm projects immune from supply-chain attacks. npm is still susceptible to malware...

SUSE-SU-2026:20428-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to version 1.25.7. Security issues fixed: - CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session...

PT-2026-8026

Name of the Vulnerable Software and Affected Versions ADB Explorer versions prior to Beta 0.9.26020 Description ADB Explorer, a fluent UI for ADB on Windows, contains a flaw due to Insecure Deserialization, potentially leading to Remote Code Execution. The application deserializes the App.txt...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.2) potentially affected by CVE-2025-56647 via @farmfe/core (1.6.6)

@farmfe/core NPM version 1.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on @farmfe/core and may be impacted: - modern-web-swiss-army-knife =2.7.0, =2.7.2 Source cves: CVE-2025-56647 Source advisory: SNYK:JS-FARMFECORE-15282805...

CVE-2026-0910

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforodisplayarraydata' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

11ty-nunjucks-md (1.0.0), 20ful (>=0.3.2, <=0.3.5) +2757 more potentially affected by CVE-2026-2327 via markdown-it (>=13.0.0, <=14.1.0)

markdown-it NPM version =13.0.0, =0.3.2, =0.0.2, =2.0.0-beta.1, =0.3.1, =0.42.46, =2.0.4, =0.0.1, =0.33.4, =0.3.0, =10.22.0, =3.7.0-beta.1, =3.9.0-beta.1, =3.9.3 and more Source cves: CVE-2026-2327 Source advisory: OSV:GHSA-38C4-R59V-3VQW...

ASUS Live Update < 3.6.8 Embedded Malicious Code (CVE-2025-59374)

The version of ASUS Live Update installed on the remote host is prior to 3.6.8 and, therefore, affected by an embedded malicious code vulnerability. - Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The...

ISC BIND 9.20.0 < 9.20.11 / 9.20.9-S1 < 9.20.11-S1 / 9.21.0 < 9.21.10 Assertion Failure (cve-2025-40777)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2025-40777 advisory. - If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer- client-timeout set to 0 the...

@cognigy/cognigy-cli (>=1.9.7, <=2.1.0), @forestadmin/agent (>=1.71.0, <=1.72.9) +15 more potentially affected by CVE-2026-26019 via @langchain/community (>=1.0.0, <=1.1.12)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.2.0, =0.0.16, =1.4.13, =1.0.24, =1.0.0, =3.1.0, =0.3.0, =0.0.210, =0.0.259 and more Source cves: CVE-2026-26019 Source advisory: SNYK:JS-LANGCHAINCOMMUNITY-15268428...