-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +17085 more potentially affected by CVE-2026-67312 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-67312 Source advisory: SNYK:JS-AXIOS-18060165...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1564 more potentially affected by CVE-2026-67312 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67312 Source advisory: OSV:GHSA-PMV8-RQ9R-6J72...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...

Exploit for CVE-2026-63030

Lab — CVE-2026-63030 “wp2shell” + CVE-2026-60137 Ambiente D...

CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Linux Distros Unpatched Vulnerability : CVE-2026-44359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered ...

GARAGE: Characterizing the Automation Boundary in LLM-Based Attack Graph Generation

While modern vehicle security depends on effective Cyber Threat Intelligence CTI synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an...

CVE-2026-44359: Improper Control of Generation of Code

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

MAL-2026-11044 Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Linux Distros Unpatched Vulnerability : CVE-2026-64046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type rig...

BIT-DRUPAL-2026-55804 Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359

The CVE describes a flaw in Meshtastic’s GitHub workflow (main_matrix.yml) prior to version 2.7.21.1370b23 where pull_request_target could trigger jobs that check out attacker forks and execute attacker-controlled files with repository secrets and elevated GITHUB_TOKEN permissions. External PRs w...

CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

EUVD-2026-45620

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...