MAL-2026-2619 Malicious code in upstartloans (npm)

Collects and exfiltrates sensitive data credentials, keys, history to p1s.uk with disabled SSL validation. Suspicious postinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a1d5c610e0cc5ec6be53b8d0d986d5ddef30937d04c977998db4c2d4b0be908 The package...

Malicious code in upstart-lending-status (npm)

Package is malware. It steals credentials, collects system info, and exfiltrates data to a remote server via postinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 627a2802a53ad7eb751fcac4b0a43245c6b0bf9e667db77051758b24d8bc4d96 The package...

MAL-2026-2611 Malicious code in upstart-lending-status (npm)

Package is malware. It steals credentials, collects system info, and exfiltrates data to a remote server via postinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 627a2802a53ad7eb751fcac4b0a43245c6b0bf9e667db77051758b24d8bc4d96 The package...

Malicious code in upstartapplicationstatus (npm)

Package is malware. Collects and exfiltrates sensitive info SSH keys, credentials, env vars via insecure HTTPS/HTTP after install. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e154270d6b3540f095f5fc77ab1167448e967009cbb719f6fc087c32fadce15f The package...

MAL-2026-2616 Malicious code in upstartapplicationstatus (npm)

Package is malware. Collects and exfiltrates sensitive info SSH keys, credentials, env vars via insecure HTTPS/HTTP after install. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e154270d6b3540f095f5fc77ab1167448e967009cbb719f6fc087c32fadce15f The package...

MAL-2026-2612 Malicious code in upstart-loan-status (npm)

Malicious package with postinstall script exfiltrating sensitive system data to a remote server. Multiple YARA rules and LLM analysis confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e7850b2e1fe8a8eeebd2a8593220743deeacbed610ada8e460fcd15bc51c732 The...

MAL-2026-2614 Malicious code in upstart.previewcss (npm)

Package is malware. It collects and exfiltrates sensitive data SSH keys, credentials, environment variables and system info to a remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd2d5c329f24c54ca68ce21884867d6b4db6ae64d0e2041af60deb2203cc8830 The...

Malicious code in upstart.previewcss (npm)

Package is malware. It collects and exfiltrates sensitive data SSH keys, credentials, environment variables and system info to a remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd2d5c329f24c54ca68ce21884867d6b4db6ae64d0e2041af60deb2203cc8830 The...

Malicious code in pinstatsd (npm)

Package is malware due to data exfiltration to multiple domains via DNS and HTTPS, along with a suspicious preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ae52dde0a4efddd6d12bc4795b77da5433cb750b4ddb852f1aca27ea457e The package pinstatsd w...

MAL-2026-2654 Malicious code in pinstatsd (npm)

Package is malware due to data exfiltration to multiple domains via DNS and HTTPS, along with a suspicious preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ae52dde0a4efddd6d12bc4795b77da5433cb750b4ddb852f1aca27ea457e The package pinstatsd w...

Malicious code in pinlogger (npm)

The package is a malware due to system info exfiltration via DNS/HTTPS to OAST domains and arbitrary code execution during preinstall. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e78bb72f47ecca78511d87a17bea5f38fb4897dbc117433dfd7667cd97a51d0 The package...

Malicious code in wm-plugin-visions-recorder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9fc7d1b94e873a6acaa539c03b3deb578141de07e79343acb659b17d4815077 The package wm-plugin-visions-recorder was found to contain malicious code. Source: ghsa-malware...

PT-2026-54328

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient policy enforcement in Extensions allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Recommendations...

PT-2026-46667

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An out of bounds read exists in Chromecast, which occurs when a program reads data outside the intended boundary of a buffer. This allows a remote attacker who has compromised the...

PT-2026-54168

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input within the Extensions component allows a remote attacker who has already compromised the renderer process to achieve privilege escalation. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-40175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in...

SUSE CVE-2026-34178

In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An...

CVE-2026-39983

A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed CRLF sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple command...

CVE-2026-40175

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...

CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...