MAL-2026-6146 Malicious code in actionbars-infinitescroll-searchbar (npm)

The npm package actionbars-infinitescroll-searchbar published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...

MAL-2026-6166 Malicious code in jest-macos (npm)

The npm package jest-macos published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6148 Malicious code in async-protobuf-av (npm)

The npm package async-protobuf-av published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in streaming-downloads (npm)

The npm package streaming-downloads published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

binutils:fuzz_objdump_safe: Heap-buffer-overflow in byte_get_little_endian

Detailed Report: https://oss-fuzz.com/testcase?key=6367976782364672 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdumpsafe Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7afd389e048c Crash State: bytegetlittleendian...

assimp:assimp_fuzzer: Use-of-uninitialized-value in Assimp::LWOImporter::CopyFaceIndicesLWO2

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5264547070672896 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzermsanassimp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

binutils:fuzz_objdump: Stack-buffer-overflow in buffer_read_memory

Detailed Report: https://oss-fuzz.com/testcase?key=4794266673807360 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdump Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Address: 0x778d11e07f54 Crash State: bufferreadmemory...

libredwg:llvmfuzz: Index-out-of-bounds in dwg_encode

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4550120497807360 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerubsanlibredwg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

MAL-2026-5978 Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

PT-2026-50332

Unauthenticated Privilege Escalation in LoginPress Pro = 6.2.2 versions...

PT-2026-50548

REDMOND, WA -- In a bold move to streamline its communications and bypass the traditional tech press altogether, Microsoft announced Tuesday that all future Windows updates and software features will be unveiled exclusively via their corresponding Common Vulnerabilities and Exposures CVE numbers...

PT-2026-50594

Name of the Vulnerable Software and Affected Versions Claude Code versions 0.2.54 through 2.1.162 Description The WebFetch tool pre-approved the hostname 'huggingface.co' as a bare hostname, allowing any path on that domain to be auto-approved without a permission prompt or restrictions from...

PT-2026-50442

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A heap buffer over-read exists in the ngx http charset module module. This occurs when content is served or proxied through a location blo...

PT-2026-50277

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...

PT-2026-50298

Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...

CVE-2026-54683

CVE-2026-54683 describes improper authorization in the NL Portal. An authenticated portal user could download documents belonging to other users when they had a valid document identifier. PT Security reports that an earlier fix for CVE-2026-49463 was incomplete, with an unused authorization param...

PT-2026-50439

Name of the Vulnerable Software and Affected Versions NGINX Open Source versions 1.31.0 through 1.31.1 NGINX Ingress Controller affected versions not specified NGINX Gateway Fabric affected versions not specified NGINX Instance Manager affected versions not specified Description A use-after-free...

PT-2026-50547

Today I received a public security credit for a vulnerability I responsibly disclosed: CVE-2026-54683 – Improper authorization in NL Portal The vulnerability allowed any authenticated portal user to download documents belonging to other users when they had access to a valid document identifier. A...

PT-2026-50546

Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - Document content. A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has...