urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4600 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

Exploit for CVE-2025-4138

CVE-2025-4138 — Python tarfile filter="data" Bypass Arbitra...

Exploit for CVE-2025-4517

CVE-2025-4517 / CVE-2025-4330 — Python tarfile Data Filter B...

Exploit for Incorrect Authorization in Suse Pam-Config

CVE-2025-6018 + CVE-2025-6019 Exploit Chain This exploit was...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by unknown CVE via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-AGENTS-15282793...

@jamietanna/renovate-graph (0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by unknown CVE via renovate (>=42.92.4, <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph 0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves: unknown CVE...

CVE-2026-26208

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allo...

CVE-2026-26208

CVE-2026-26208 affects ADB Explorer (Windows). It is vulnerable to insecure deserialization via JSON settings file deserialization: the app deserializes App.txt with Json.NET in which TypeNameHandling is set to Objects, enabling a crafted JSON file (for example containing an ObjectDataProvider ga...

Malicious Package

Overview sinon-web3-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

MAL-2026-896 Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

Several state-sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea, and Russia have trained their sights on the defense industrial base DIB sector, according to findings from Google Threat Intelligence Group GTIG. The tech giant's threat intelligence division...

Authentication Bypass

Apache Shiro is vulnerable to Authentication Bypass. The vulnerability is due to inconsistent case handling between Shiro’s filter chain matching and the underlying case-insensitive filesystem, where filter rules may be defined only for lower-case paths while the filesystem resolves file names...

OESA-2026-1347 python-urllib3 security update

HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fixes: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious...

npm’s Update to Harden Their Supply Chain, and Points to Consider

In December 2025, in response to the Sha1-Hulud incident, npm completed a major authentication overhaul intended to reduce supply-chain attacks. While the overhaul is a solid step forward, the changes don’t make npm projects immune from supply-chain attacks. npm is still susceptible to malware...

SUSE-SU-2026:20428-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to version 1.25.7. Security issues fixed: - CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session...

PT-2026-8026

Name of the Vulnerable Software and Affected Versions ADB Explorer versions prior to Beta 0.9.26020 Description ADB Explorer, a fluent UI for ADB on Windows, contains a flaw due to Insecure Deserialization, potentially leading to Remote Code Execution. The application deserializes the App.txt...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:GHSA-435G-FCV3-8J...