MAL-2026-10816 Malicious code in @gocortexio/npmgremlinbox-cpol-1-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2184d51efaa813eba204f724caf876441f354323d358251674a60def88a83e9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10798 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab67244a2c791ff06e830004b8fccdbc75449d2c0b85b15b9fa2e2fa995f676 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

MAL-2026-10794 Malicious code in @gocortexio/npmgremlinbox-c-uda-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83660c96e8a26e9d1536cf10894cf347defb7ff139add7b3ecb738ee69029dfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10785 Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b9f161ff7fd8e7bf1fd1496277f6839c49d06cb7dd0e6daf772a019fb46b1cd No a static rule matches and no traced malicious behavior were observed in this package version. No credential access, no install/import-time network...

CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

PT-2026-66656

The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...

PT-2026-61584

Name of the Vulnerable Software and Affected Versions QEMU Guest Agent affected versions not specified Description A flaw exists in the QEMU Guest Agent qga within the guest-ssh-add-authorized-keys command handler. A local unprivileged user can exploit this by manipulating symbolic links through ...

ROS-20260720-73-0075

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability could allow an attacker to disclose protected information...

The vulnerability of the External Tools module in the integrated Studio 5000 Logix Designer environment allows a hacker to execute arbitrary code.

The vulnerability of the External Tools module in the integrated Studio 5000 Logix Designer environment is related to the absence of quotation marks when writing elements or search paths. Exploiting this vulnerability can allow an attacker to execute arbitrary code by sending a specially created...

The vulnerability of the integrated design environment of Studio 5000 Logix Designer, related to deficiencies in the authentication process, allows a malicious actor to execute arbitrary code.

The vulnerability of the integrated design environment Studio 5000 Logix Designer is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to execute arbitrary code by replacing the configuration file of external tools...

Linux Distros Unpatched Vulnerability : CVE-2026-12080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by...

MAL-2026-10781 Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359

The CVE describes a flaw in Meshtastic’s GitHub workflow (main_matrix.yml) prior to version 2.7.21.1370b23 where pull_request_target could trigger jobs that check out attacker forks and execute attacker-controlled files with repository secrets and elevated GITHUB_TOKEN permissions. External PRs w...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

OESA-2026-3001 openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the...

XML External Entity (XXE) Injection

Overview mpxj is a Python wrapper for the MPXJ Java library for manipulating project files Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. ...

XML External Entity (XXE) Injection

Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...