CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70607

CVE-2026-70607 affects Electron: prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, window.open() features strings could apply untrusted window options to a new BrowserWindow if the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This could le...

MAL-2026-12829 Malicious code in bi-core-bi-core-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1 On require of the package, index.js triggers compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled...

Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12411 Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

MAL-2026-12447 Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

Metasploit Framework 6.5 Released

Today we’re proud to announce that Metasploit Framework version 6.5 has been released. Over the past two years, with the help of countless contributors, we’ve added 422 new modules along with a whole slew of new features. Malleable C2 Profiles for HTTP One of the latest and most requested feature...

PT-2026-65860

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-64741

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier...

EUVD-2026-49556

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker in physical proximity may be able to corrupt process memory...

PT-2026-65193

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versio...

PT-2026-65207

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description An out-of-bounds read occurs due to insufficient...

[SECURITY] Fedora 43 Update: dotnet10.0-10.0.110-1.fc43

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 44 Update: dotnet10.0-10.0.110-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 43 Update: dotnet8.0-8.0.129-2.fc43

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 44 Update: dotnet8.0-8.0.129-2.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...