Malicious code in console-fmt-cli (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. console-fmt-cli uses a side-loader technique: it declares decimal-format-core =3.0 as a dependency, which contains a dropper that executes at install time via a postinstall hook. The dropper fetches a...

Malicious code in log-taker1 (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...

Security update for perl-Config-IniFiles (important)

openSUSE security update: security update for perl-config-inifiles ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21012-1 Rating: important References: bsc1268236 Cross-References: CVE-2026-11527 CVSS scores: CVE-2026-11527 SUSE : 8.6...

Amazon Linux 2023 : rclone (ALAS2023-2026-1907)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1907 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD reques...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.22), org.apache.tomee:apache-tomee (11.0.0-m1) +10 more potentially affected by CVE-2026-50229 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.22)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =3.0.0, =3.0.0, =11.0.0, =11.1.2 Source cves: CVE-2026-50229 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734719...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.55), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.55)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734714...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.4) potentially affected by CVE-2026-55957 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.4)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.4 Source cves: CVE-2026-55957 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733812...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.36), org.apache.tomee:apache-tomee (>=10.0.0-m1, <=10.0.0) +10 more potentially affected by CVE-2026-55957 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.36)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2026-55957 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733812...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.83, <=9.0.118), org.openl.rules.demo:openl-demo-app (>=5.25.16, <=5.25.17) +1 more potentially affected by CVE-2026-53434 via org.apache.tomcat:tomcat (>=9.0.83, <=9.0.118)

org.apache.tomcat:tomcat MAVEN version =9.0.83, =9.0.83, =5.25.16, =8.0.25, =10.1.0 Source cves: CVE-2026-53434 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733745...

AgentTesla Config Extractor

Analyze AgentTesla .NET payloads: locate string-decryption methods, invoke them with IL-derived keys under a watchdog timeout, and extract likely C2 indicators HTTP, SMTP, FTP. Requires pythonnet and dnlib.dll. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract C2 configuration from AgentTesla...

Enumerate Redis Configuration

Dump security-relevant Redis server configuration from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Enumerate Redis Configuration", "description": "Dump security-relevant Redis server configuration", "author": "KittySplo...

Malicious Package

Overview @gm-rvg/root-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @gm-rvg/root-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 439c6ce041ad5226eefdab8b99045e573701e66838e908be4fa6d3b0ee6e8a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-53925

A flaw was found in Glances, an open-source system monitoring tool. The securepopen function, which executes system commands, fails to properly validate command strings, allowing special operators like file redirection and command chaining to be interpreted. An attacker who can modify the Glances...

CVE-2026-13744 Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL i...

PYSEC-2026-465 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

Summary CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy --type api get a server that: -...

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

The /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.When PUBLICADDVIEW=True commo...

PYSEC-2026-283 ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

The /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. When PUBLICADDVIEW=True comm...

PYSEC-2026-402 Remote Code Execution via path traversal bypass in lollms

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder.buildextension function. The vulnerability arises from the /mountextension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure...

litellm vulnerable to remote code execution based on using eval unsafely

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the adddeployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can exploit this by sendin...