MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

Stable Channel Update for Desktop

The Stable channel has been updated to 151.0.7922.108/.109 for Windows and Mac and 151.0.7922.108 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

CVE-2026-71211

creationtimestamp| type| source ---|---|--- 2026-08-05 22:00:14+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96814 2026-08-06 00:00:10+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96814 2026-08-07 10:17:15+00:00| seen|...

CVE-2026-71319

Nuxt DevTools prior to version 3.3.1 exposes an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket (ws://:/, subprotocol vite-hmr). The channel, via plugin nuxt:devtools:rpc, allows calling RPC methods without token/handshake/origin checks; updateOptions(), clearOptions(), and ...

CVE-2026-70616

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

CVE-2026-98198

creationtimestamp| type| source ---|---|--- 2026-08-05 19:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96789 2026-08-06 00:00:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96789 2026-08-07 10:17:15+00:00| seen|...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

UBUNTU-CVE-2026-14587

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-14587

Neo4j Bolt handshake decoder mishandles an overlong capability bitmask: when an unauthenticated client sends a protocol version followed by 32 continuation bytes, the decoder resets its reader index and waits for more data instead of rejecting the message and closing the channel, leaving the conn...

EUVD-2026-53446

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

MAL-2026-13253 Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

MAL-2026-13293 Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...