Malicious code in systemtest-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8fadd3f7e7470daeb4e977c85dbe226a9225b2c4eae6c269a4d85fc01e96681 The package systemtest-network was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-prop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6708dacd87e4aafa4ffafa5b20fff5ae416d6580ba01ddcaaa51ca08f0317c85 The package chai-prop was found to contain malicious code. Source: ghsa-malware 46a6572ddbd6c8ceef059f6e07126d160a849cf4912b1befe7b4523393c72484 Any...

CVE-2026-2248

METIS WIC devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root UID 0 privileges. This results in full system compromis...

CVE-2025-48722

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4...

MAL-2026-854 Malicious code in sinon-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9ac1d9ff3647908703db921b2e950e479861f18e7b1bad8377baaa7400d32c The package sinon-node was found to contain malicious code. Source: ghsa-malware 5aa93130bd1915120b30dc2472c774ac984ea2c2166d7865d30fdf8343225f50 Any...

Malicious code in chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 463f0440f6a90a98f9a12131b19f99b472b0ee82b6feb5b6066996ca4be4e07a The package chai-await was found to contain malicious code. Source: ghsa-malware c3cd8be2d97babb314b0adf3d3b9b6467057d39f64e41afe5d5f33cad5e3fbe6 Any...

CVE-2026-0488

An authenticated attacker in SAP CRM and SAP S/4HANA Scripting Editor could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impa...

PT-2026-7597

METIS WIC devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root UID 0 privileges. This results in full system compromis...

Security Assessment of Intel TDX with Support for Live Migration

In the second and third quarters of 2025, Google collaborated with Intel to conduct a security assessment of Intel Trust Domain Extensions TDX, extending Google's previous review and covering major changes since Intel TDX Module 1.0 - namely support for Live Migration and Trusted Domain TD...

PT-2026-7545

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A flaw exists in Qsync Central that, if exploited by a remote attacker with a user account, could lead to a denial-of-service DoS attack. The issue is a NULL pointer dereference...

Exploit for CVE-2026-1560

CVE-2026-XXXX – Authenticated Remote Code Execution in Lazy Bl...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

CVE-2025-68686

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability CWE-200 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypas...

MAL-2026-833 Malicious code in express-configer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e492b9087ab21198777e586b9d21eade1fe2948bb67f1ab484c7274056861276 The package express-configer was found to contain malicious code. Source: ghsa-malware 8484436a0b43b94054c0fa7ceb955362a6557d9bef3019e2fae2e51e42ff1f...

MAL-2026-830 Malicious code in aligners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d584eeb0828c4c86b7ae383fff091f8bb711aff14a9d8a507bfdd0ada40ecb5 The package aligners was found to contain malicious code. Source: ghsa-malware fa92eba5bbd1fb9325eefaa7c363cd2827b4b4e381776d06090a0cbb001d96af Any...

80% of Fortune 500 use active AI Agents: Observability, governance, and security shape the new frontier

Today, Microsoft is releasing the new Cyber Pulse report to provide leaders with straightforward, practical insights and guidance on new cybersecurity risks. One of today’s most pressing concerns is the governance of AI and autonomous agents. AI agents are scaling faster than some companies can s...

MAL-2026-835 Malicious code in sap-code-style-guides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13203a88392c91986f587e28ca25120b54f0c4d4ee5dd2c330c2bbbe6243203a The package sap-code-style-guides was found to contain malicious code. Source: ghsa-malware...

Malicious code in bigmathix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b200be57a4cdb466d56397968f69dd3845955ced56c5229608dbf03762106ff9 The package bigmathix was found to contain malicious code. Source: ghsa-malware 5fce43c0e03186c2441c8a54be7cb130625459fe9179665e242f223f0c7d2944 Any...

MAL-2026-831 Malicious code in bigmathix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b200be57a4cdb466d56397968f69dd3845955ced56c5229608dbf03762106ff9 The package bigmathix was found to contain malicious code. Source: ghsa-malware 5fce43c0e03186c2441c8a54be7cb130625459fe9179665e242f223f0c7d2944 Any...

CVE-2025-68686

CVE-2025-68686 affects Fortinet FortiOS across multiple branches (7.6.0–7.6.1, 7.4.0–7.4.6, 7.2.x, 7.0.x, 6.4.x). It permits a remote unauthenticated attacker to bypass the patch for the symbolic link persistency mechanism via crafted HTTP requests, resulting in exposure of sensitive information....