crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

Root-the-Box

EH-Stage6: Exploit Chain as Code This repository contains my...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +954 more potentially affected by CVE-2026-16729 via undici (>=7.0.0, <=7.28.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.0, =0.26.4, =0.0.33, =0.3.2 and more Source cves: CVE-2026-16729 Source advisory: SNYK:JS-UNDICI-18426061...

@aulazero/task (>=0.0.1, <=0.7.2), @aulazero/task-2 (>=2.0.1, <=2.0.5) +276 more potentially affected by CVE-2025-29049 +1 more via mathlive (>=0.25.0, <=0.109.2)

mathlive NPM version =0.25.0, =0.0.1, =2.0.1, =1.17.3, =0.2.6, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.20.0, =11.25.1, =1.0.0, =0.1.0, =0.1.0-alpha.1, =0.2.41 and more Source cves: CVE-2025-29049, CVE-2026-54705 Source advisory: SNYK:JS-MATHLIVE-18508174...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +10058 more potentially affected by CVE-2026-67213 via nanoid (>=3.0.0, <=3.3.17)

nanoid NPM version =3.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =1.0.0, =0.1.3, =1.0.0, =0.3.0, =0.0.1-alpha.0, =0.0.1-alpha.3, =0.0.1-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.1-alpha.11 and more Source cves: CVE-2026-67213 Source advisory: OSV:GHSA-2V37-7H3G-55P8...

5c-2023 (>=1.0.88, <=1.0.317), 5c-angle (>=0.0.1, <=0.0.3) +5410 more potentially affected by CVE-2026-67213 via nanoid (>=4.0.0, <=5.1.5)

nanoid NPM version =4.0.0, =1.0.88, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2026-67213 Source advisory: OSV:GHSA-2V37-7H3G-55P8...

02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +10045 more potentially affected by CVE-2026-67214 via nanoid (>=3.0.0, <=3.3.15)

nanoid NPM version =3.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =1.0.0, =0.1.3, =1.0.0, =0.3.0, =0.0.1-alpha.0, =0.0.1-alpha.3, =0.0.1-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.1-alpha.11 and more Source cves: CVE-2026-67214 Source advisory: OSV:GHSA-28WG-GHJ8-5HJV...

@easyv/swagger-api-types (0.1.7), @evergis/api (>=4.1.7, <=5.0.54) +23 more potentially affected by CVE-2026-54662 via swagger-typescript-api (>=13.0.1, <=13.6.5)

swagger-typescript-api NPM version =13.0.1, =4.1.7, =1.3.4, =1.4.0, =0.0.65, =0.0.1, =0.0.1, =0.0.7-rc2, =1.2.5, =1.0.7, =0.1.5, =1.2.3, =1.2.6, =1.2.7 and more Source cves: CVE-2026-54662 Source advisory: OSV:GHSA-HQJ5-CW9F-RX67...

CVE-2026-59251

A flaw was found in Erlang/OTP's publickey application. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted X.509 certificate chain during a Transport Layer Security TLS handshake. This causes the certificate path validation process to consume excessiv...

chatgpt-panic-hook (>=0.1.1, <=0.1.5), formation-chess-web (0.2.0) +5 more potentially affected by unknown CVE via webbrowser (1.0.0)

webbrowser CARGO version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on webbrowser and may be impacted: - chatgpt-panic-hook =0.1.1, =0.2.0, =0.13.2, =0.1.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0257...

Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious Package

Overview chain-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11181 Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious Package

Overview chain-analyze is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

vet v1.18.0

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...

web-check v2.2.0

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: Terminal Trove The $HOME of all things in the terminal | Warp Built for coding with multiple AI agents ---|--- Contents About Screenshot Live Demo Mirror Features Usage Deployment...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...