EUVD-2026-23742

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The...

Weaponizing the Commons: A Taxonomy and Detection Framework of Abuse on GitHub

GitHub plays a critical role in modern software supply chains, making its security an important research concern. Existing studies have primarily focused on CI/CD automation, collaboration patterns, and community management, while abuse behaviors on GitHub have received little systematic...

The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables

An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supp...

PT-2026-33634

Name of the Vulnerable Software and Affected Versions UltraDAG version 0.1 Description A non-council attacker can submit a signed 'SmartOp::Vote' transaction that successfully passes signature, nonce, and balance prechecks. However, the authorization check fails only after state mutation has...

GHSA-4C3Q-X735-J3R5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

Executive Summary This report documents a critical security research finding in the compressing npm package specifically tested on the latest v2.1.0. The core vulnerability is a Partial Fix Bypass of CVE-2026-24884. The current patch relies on a purely logical string validation within the...

CVE-2026-32280

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

PT-2026-33550

Name of the Vulnerable Software and Affected Versions compressing versions prior to 1.10.5 compressing versions prior to 2.1.1 Description A patch bypass exists in the isPathWithinParent function located in lib/utils.js. The issue stems from a divergence between logical string validation and the...

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Summary A Server-Side Request Forgery SSRF vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass th...

CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

EUVD-2026-23310

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

Hidden Passenger? How Taboola Routes Logged-In Banking Sessions to Temu

A bank approved a Taboola pixel. That pixel quietly redirected logged-in users to a Temu tracking endpoint. This occurred without the bank’s knowledge, without user consent, and without a single security control registering a violation. Read the full technical breakdown in the Security Intelligen...

Malicious code in relion-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650bf9452e7eaed5b89edb5f2af6208d4491aa079a90805fd6360b32ee6ff6d8 The package relion-chain was found to contain malicious code...

MAL-2026-2796 Malicious code in relion-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650bf9452e7eaed5b89edb5f2af6208d4491aa079a90805fd6360b32ee6ff6d8 The package relion-chain was found to contain malicious code...

Malicious code in metrify-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898154f06df814bd48f3b479a605e61fcffebfc9ce5c39a6904ba24a907ac78 The package metrify-chain was found to contain malicious code...

MAL-2026-2779 Malicious code in metrify-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6898154f06df814bd48f3b479a605e61fcffebfc9ce5c39a6904ba24a907ac78 The package metrify-chain was found to contain malicious code...

Malicious code in chain-syncora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6d15e07fe0ec278f0437e4e651444bca1fa0cfac0f3cb50e06224e2fa3fde45 The package chain-syncora was found to contain malicious code...

MAL-2026-2745 Malicious code in chain-syncora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6d15e07fe0ec278f0437e4e651444bca1fa0cfac0f3cb50e06224e2fa3fde45 The package chain-syncora was found to contain malicious code...

Malicious code in chain-metrica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb624dbdf0ad26818c6d6685e22838c8bbb23d223376ba009f53500ca469ad86 The package chain-metrica was found to contain malicious code...

MAL-2026-2744 Malicious code in chain-metrica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb624dbdf0ad26818c6d6685e22838c8bbb23d223376ba009f53500ca469ad86 The package chain-metrica was found to contain malicious code...