MAL-2026-10790 Malicious code in @gocortexio/npmgremlinbox-arphic-1999 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59cc9e27f4b008a76815433e388b21dadcb6477f6daee80a855b6eaeaf4a79f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10792 Malicious code in @gocortexio/npmgremlinbox-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3905018e59676370cb9b0ce2f68f53df18b3ca774fafd9445bd3ce202ab0249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10795 Malicious code in @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76e5b6e244c7645a990797de600bbe5b61534485f8037ec0b8b865a50c10b523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10794 Malicious code in @gocortexio/npmgremlinbox-c-uda-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83660c96e8a26e9d1536cf10894cf347defb7ff139add7b3ecb738ee69029dfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10791 Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54621aca82e78e4ee4adc57b3925274a0c7bf3b2d11d6d5af655c584de7fa45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

MAL-2026-10793 Malicious code in @gocortexio/npmgremlinbox-busl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fde0f39d1aa2fb79d17f5582fc5044520af5bbbc864b910954b1476eeb62b6b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10788 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

MAL-2026-10786 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d73fb2c55c8b46079aed067487fdfbd542e8308ed577463f7d9ab02a7c06447 No a static rule matches and no traced-code findings indicate installer harm in this version. The package artifacts show no credential access, no...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ec6a36621ce352ab4510c339ef6a7367f88584b90ebfda17149c79dd947c66 No a static rule matches and no traced installer-harm behaviors were identified in this package version. No lifecycle-script droppers, hardcoded...

Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b9f161ff7fd8e7bf1fd1496277f6839c49d06cb7dd0e6daf772a019fb46b1cd No a static rule matches and no traced malicious behavior were observed in this package version. No credential access, no install/import-time network...

MAL-2026-10784 Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6b2260e2800619ccb9a093618b29bba531fdca6348febc8547be7d925da7b4c No a static rule matches and no traced behavioral findings were produced for this package version. With no evidence of exfiltration, install-time...

MAL-2026-10785 Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b9f161ff7fd8e7bf1fd1496277f6839c49d06cb7dd0e6daf772a019fb46b1cd No a static rule matches and no traced malicious behavior were observed in this package version. No credential access, no install/import-time network...

Exploit for CVE-2026-60137

Compromise Scanner for wp2shell read-only A standalone, r...

OESA-2026-3031 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

OESA-2026-3005 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...

CVE-2026-8635

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions...

GO-2026-5938 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy...

CVE-2026-8635

Security bulletin confirms CVE-2026-8635 affects Langflow OSS versions 1.0.0–1.10.0 where an authenticated user can exploit the Python Interpreter component to execute arbitrary code, bypass controls, and escalate to superuser by manipulating the database, potentially compromising the Langflow se...