RHCOS 4 : OpenShift Container Platform 4.18.54 (RHSA-2026:57482)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57482 advisory. - net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 - crypto/x509: golang: golang crypto/x509: Denial of...

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...

MAL-2026-15674 Malicious code in bamru (npm)

This package presents itself as a "System binary configuration tool" — that is its entire manifest description, with keywords system, binary, util and config, an author of "SysDev", and no repository. What it actually installs is a concealed clipboard and screen harvester that elevates itself to...

MAL-2026-14508 Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f6b00b26052d34947326afc5e17df34500b077e8ed58daa9e9f67c3a93737e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3c51575af766a500130198af6b3b93efbc81f522edb9e0deec2a9da0a421db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14512 Malicious code in tailwind-scrollbar-hider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaa2dba899c9723740dfcc2fe8588bcf695f021442bbe8de1156239029bf7987 dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes evalatob'' at module top level, so the payload runs on any...

MAL-2026-14504 Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE-SU-2026:3799-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead t...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance , which could result in the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment. The CNA-assigned CVSS 3.1 score is 4.2 (MEDIUM) , reflecting a network vector with high comple...

CVE-2026-21753 HCL Hive is affected by multiple security vulnerabilities.

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...

EUVD-2026-65470

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...

CVE-2026-78572

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-78572

The Kalles Addons plugin for WordPress (versions up to and including 1.0.6 ) is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing unauthenticated attackers to inject a PHP Object. No known POP chain exists within the plugin itself, so impact depends on whether an...

EUVD-2026-65355

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78572

...

Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

MAL-2026-14484 Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...