malcontent 安全漏洞

Malcontent is a supply chain attack detection tool developed by Chainguard. Versions of Malcontent prior to 1.21.0 contained a security vulnerability. This vulnerability stemmed from the deletion of nested archives that failed to extract data, potentially leaving malicious content behind...

PT-2026-22408

Name of the Vulnerable Software and Affected Versions malcontent versions prior to 1.21.0 Description malcontent is software used to discover supply-chain compromises through context, differential analysis, and YARA. A logic error exists where the software removes nested archives that fail to...

Formal Analysis and Supply Chain Security for Agentic AI Skills

The rapid proliferation of agentic AI skill ecosystems -- exemplified by OpenClaw 228,000 GitHub stars and Anthropic Agent Skills 75,600 stars -- has introduced a critical supply chain attack surface. The ClawHavoc campaign January-February 2026 infiltrated over 1,200 malicious skills into the...

Improper Authentication

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Improper Authentication in the Chat Trigger node when configured with n8n User Auth authentication. An attacker can gain unauthorized access by circumventing the authentication check. Note: This is only...

@0xyy/elpis (>=1.0.0, <=1.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1511 more potentially affected by CVE-2026-27959 via koa (>=2.0.0, <=2.16.3)

koa NPM version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.1.3 - @ahua0920/elpis 1.0.0 and more Source cves: CVE-2026-27959 Source advisory: OSV:GHSA-7GCC-R8M5-44QM...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4218 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =1.52.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-27942 Source advisory: OSV:GHSA-FJ3W-JWP8-X2G3...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +317 more potentially affected by CVE-2026-27904 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

How to understand and avoid Advanced Persistent Threats

By definition, an advanced persistent threat APT is a prolonged, targeted attack on a specific victim with the intention to compromise their system and gain information from or about that target. About a decade ago, the term was mostly used for state-sponsored threat actors. I used threat actors...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @cedarjs/cli-storybook-vite (>=1.0.0-canary.12742, <=1.0.0-canary.12784) +15 more potentially affected by CVE-2026-27148 via storybook (>=8.7.0-alpha.0, <=9.1.18)

storybook NPM version =8.7.0-alpha.0, =0.0.1, =1.0.0-canary.12742, =2.0.0-beta.3, =0.0.2-alpha.0, =1.0.0, =1.1.0, =0.1.80, =9.0.0-alpha.0, =8.7.0-alpha.0, =9.0.0-alpha.2, =9.0.0-alpha.0, =1.2.1, =0.0.75-beta.11, =1.2.7-beta.2 and more Source cves: CVE-2026-27148 Source advisory:...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-27903 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

10up-toolkit (>=6.0.0-next.0, <=6.5.1), @0ti.me/ts-test-deps (0.2.0) +6563 more potentially affected by CVE-2026-27904 via minimatch (>=9.0.0, <=9.0.6)

minimatch NPM version =9.0.0, =6.0.0-next.0, =1.1.0-pre.1, =1.4.0, =9.1.0, =1.17.3-testing-284.48.0, =1.0.0, =1.1.6, =0.0.0-alpha.1011313d2aaf, =1.1.3, =1.0.6, =1.0.25 and more Source cves: CVE-2026-27904 Source advisory: SNYK:JS-MINIMATCH-15353387...

CLEANSTART-2026-VU62737 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-KK99760 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

Lifecycle-Integrated Security for AI-Cloud Convergence in Cyber-Physical Infrastructure

The convergence of Artificial Intelligence AI inference pipelines with cloud infrastructure creates a dual attack surface where cloud security standards and AI governance frameworks intersect without unified enforcement mechanisms. AI governance, cloud security, and industrial control system...

0.2-ui (0.0.1), 1k-tasks (>=2.3.0, <=3.0.2) +2394 more potentially affected by CVE-2026-27606 via rollup (>=2.0.0, <=2.79.2)

rollup NPM version =2.0.0, =2.3.0, =1.0.17, =1.0.0-canary.1, =0.0.74, =0.0.14, =1.0.0, =0.0.10, =0.0.3, =1.0.1, =1.0.12, =1.0.0, =0.0.4, =0.0.5 and more Source cves: CVE-2026-27606 Source advisory: OSV:GHSA-MW96-CPMX-2VGC...

@kyuda/n8n-nodes-databricks (>=2.0.0, <=2.0.6), @kyuda/n8n-nodes-databricks-simplified (1.0.0) +20 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=2.0.0, <=2.9.0)

n8n-workflow NPM version =2.0.0, =2.0.0, =0.2.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.1.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.9.0 and more Source cves: CVE-2025-68613, CVE-2026-27577 Source advisory: SNYK:JS-N8NWORKFLOW-15357609...

CVE-2026-27628

A flaw was found in pypdf. Processing a specially crafted PDF document, specifically with circular /Prev references in the cross-reference xref chain, can cause an infinite loop and a high consumption of CPU, resulting in a denial of service. Mitigation Mitigation for this issue is either not...

Top 5 Ways Broken Triage Increases Business Risk Instead of Reducing It

Triage is supposed to make things simpler. In a lot of teams, it does the opposite. When you can’t reach a confident verdict early, alerts turn into repeat checks, back-and-forth, and “just escalate it” calls. That cost doesn’t stay inside the SOC; it shows up as missed SLAs, higher cost per case...

SUSE-SU-2026:0635-1 Security update for python-urllib3_1

This update for python-urllib31 fixes the following issues: - CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. - CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866. -...

10-javascriptlib (1.0.0), 1k-tasks (>=3.1.0, <=3.6.1) +449 more potentially affected by CVE-2026-27606 via rollup (>=3.0.0, <=3.29.5)

rollup NPM version =3.0.0, =3.1.0, =9.0.19, =0.0.2, =4.0.0-alpha.2, =0.6.0, =12.0.0, =0.0.3, =1.6.3, =3.2.0, =0.1.0, =0.0.4, =3.0.1-canary.8, =3.0.1-canary.12 and more Source cves: CVE-2026-27606 Source advisory: SNYK:JS-ROLLUP-15340920...