Malicious Package

Overview @sxm-web/client-sdk-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @worca/app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @s4yhiitestpoc/r2-echo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @s4yhiitestpoc/r2-https-dualuse is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview @s4yhiitestpoc/scan-echo-b is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @s4yhiitestpoc/scan-dns-c is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @s4yhiitestpoc/scan-control-a is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-123330

A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve class name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attac...

PT-2026-125318

An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges...

PT-2026-125284

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code...

PT-2026-123412

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9...

PT-2026-123470

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix FPX JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS UNKNOWN with four...

PT-2026-123475

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JP...

Apple Security Advisory 10-26-2026-4

Apple Security Advisory 10-26-2026-4 - macOS Golden Gate 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, arbitrary code execution, and information disclosure vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-116140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. ...

VeloCloud Orchestrator SQL Injection Privilege Escalation

The vulnerability in the locally deployable version of the VeloCloud Orchestrator VCO On-Premises management platform for VMware SD-WAN by VeloCloud is related to improper handling of SQL query structures. Exploitation of this vulnerability may allow a remote attacker to escalate their privileges...

Debian dla-4858 : imagemagick - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4858 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4858-1 [email protected]...

Microsoft’s response to compromised eMudhra certificate authority keys

Update, October 27, 2026: Microsoft has removed the seven affected certificates from the Microsoft Edge trust list. We've also added more detail on why these keys pose a risk and why organizations should be cautious about restoring trust locally. There's also a link to the Microsoft Trusted Root...

CVE-2026-107091

The HUION Inspiroy Frego S (L310) Windows Driver version 20.0.1.118 contains a vulnerability that allows a local attacker to execute arbitrary code . The root cause is located within the HUION driver installer DLL-loading logic . While the vulnerability is identified, the provided documents do no...

PT-2026-123186

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load gr item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product...