MAL-2026-14712 Malicious code in 3layerdipstackcrikda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dff4e946325299e0b7aa9b7915753f7c3db5ff81df80e9e206e41f034de7fad0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackl21ibf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc6ccc6467814c4ddf095d64904d3b0d2f475dbcd599ddcf02f43329cbdbf49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14702 Malicious code in 3layerdipstackc6c5kn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c5095fa04b6e4feb276e9a1376a4b4c7644115b5ffc5021f55edbf5c5646d2c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkirw0e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81a3a4dcac52e8ca9c5e0ac1191470709d580905866ce1f9f484d26de7032c57 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14627 Malicious code in 3layerdipstack4wsms0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c375da30bd4dc753181260b33918aec7b17b0c4bc5ecd3ac06dc3676055d84f0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack2cyinb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e160520778ca6e1c474aa74fb066efea18747c08d4efbafcc7ece8ae185f5b21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackudibkf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dc0269021e9d59c08db218d5219cadb15980e4d671068382411f828fc910d59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackkysrek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d1f569a2e645d005f3e8dd8f757dfa4b26f11d80dbea28773cf8528c0501af The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack7ezqzp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13dee41790090f5b150550812f382e8f870b61223f62d02f5c79f5218e5815f7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackvkl1hd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b377c7fe1096a29a14d5b88a8976bffe545ab4fae10c8833cc53fd72c2f9a1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE-SU-2026:23364-1 Security update for c-ares

This update for c-ares fixes the following issues: Update to c-ares 1.34.8. - CVE-2025-31498: use-after-free in readanswers when processanswer may re-enqueue a query bsc1240955. - CVE-2025-62408: use-after-free due to connection being cleaned up after error bsc1254738. - CVE-2026-33630: remotely...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ZBT, each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTE...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

PT-2026-83284

Name of the Vulnerable Software and Affected Versions Hermes Agent versions 0.18.2 through 0.18.x Description A supply chain issue exists in the bundled MCP catalog. A remote attacker can execute arbitrary code by compromising a third-party upstream repository that is referenced via a mutable...

CVE-2026-81690

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CVE-2026-69249

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

OpenClaw went viral. Meet the maintainers building and securing it.

What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 202...

Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...