MAL-2026-955 Malicious code in crypto-locale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e346cfc58b0d84fb5b56985729f7ec92a226ef106b0ab10f299e65a62028834d The package crypto-locale was found to contain malicious code. Source: ghsa-malware 00686734db6a3f5477c1047f779749296dddb0c7eab5294000e13ed7b194c74d...

MAL-2026-974 Malicious code in yarsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2ed8a6379e9f5833efbabb80221cc55ce3456a95d14c77ede9ab581bd8f577 The package yarsg was found to contain malicious code. Source: ghsa-malware 71a7932af2640f624c7daef39143653ecaa9d843bda52f61c22687210fc9961d Any...

Malicious code in format-defaults (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00cab7061e49ab4c27f149d8944dbf016be470f0a6380b58d1432ce3c5dfd04 The package format-defaults was found to contain malicious code. Source: ghsa-malware 90aea488bdca1dafac7912501be1bdfb01e2304e4a110715802f98994f2c712...

MAL-2026-970 Malicious code in secp256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5474e89cc8b0f2d2e5c37d3a2bad92455e82535d614d82fb0ff96979ba1ac2d3 The package secp256 was found to contain malicious code. Source: ghsa-malware 12775af1dc40ed0560ed3a8265ad9a1c9a122b3860a9f081e190b2ad8f30ba5d Any...

Malicious code in hardhta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc27417b62c3ad399e369577764608120ee2b3662367f1d51bf5fb8378560bcf The package hardhta was found to contain malicious code. Source: ghsa-malware e4174e96a92d9c0d7bbe499ed40d2e4cab9635c61471a1602fd117d8115e2d38 Any...

MAL-2026-965 Malicious code in node-native-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9503b92533dc98c475b75c09a1c40fcec67ad7b56c488b9677c0ff0740c4d2 The package node-native-bridge was found to contain malicious code. Source: ghsa-malware...

Malicious code in suport-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa28b384b2a4def64b3573ce8177cb8db3790508b4ad7b2b92345ffa222193e8 The package suport-color was found to contain malicious code. Source: ghsa-malware ca2fb15b3d908dd99e112e290646122d415a0a43d135631603a0a007e172ef8f A...

MAL-2026-954 Malicious code in cloude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec24ba80068a14617a513915da6a3751b60345b9c1e9144a362c4b85abefdc6 The package cloude-code was found to contain malicious code. Source: ghsa-malware 8da7714f501eed0c20e3432333dc73d1707e7ef16a803df07b6d73fab1945be7 An...

MAL-2026-952 Malicious code in claud-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 858992810c1a4133d95b6fa19033c07591db548a46df39b67e0d393d7dd212ad The package claud-code was found to contain malicious code. Source: ghsa-malware 5fe9842d778d45ad5b5e4d81db678d608711dd4b186e053569dae6f210481651 Any...

MAL-2026-966 Malicious code in opencraw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaed661cc51e76234fc6cba7587b973903e00bbacd33da7114aeb726d957b577 The package opencraw was found to contain malicious code. Source: ghsa-malware 5bc39adf3939792f918a50cbc9a9952a11d950e361d83d5631449f20ad634945 Any...

PT-2026-21239

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The web management interface allows the administrator username and password to be set to blank values. After applying these blank values, the device allows...

CVE-2026-26275 httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass

httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in httpsig-hyper prior to version 0.0.23 where Digest header verification could incorrectly succeed due to misuse of Rust's matches! macro. Specifically, the comparison if matches!digest, expecteddigest treate...

Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center

Microsoft has disclosed a now-patched security flaw in Windows Admin Center that could allow an attacker to escalate their privileges. Windows Admin Center is a locally deployed, browser-based management tool set that lets users manage their Windows Clients, Servers, and Clusters without the need...

PT-2026-20726

Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through = 1.0.6...

PT-2026-42539

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.10 Description An issue exists where the '/user/update' endpoint does not restrict which fields a user can modify when updating their own account. This allows a user to change their user role to proxy admin,...

CVE-2025-15581

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access...

CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

CVE-2026-23647

Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded...

CVE-2026-23647

The CVE-2026-23647 advisory describes Glory RBG-100 recycler systems using the ISPK-08 software with hard-coded operating-system credentials embedded across multiple local accounts, including admin-privileged ones. An attacker with network access to exposed services (e.g., SSH) can authenticate u...

CVE-2026-23647 Glory RBG-100 Recycler System Hard-coded OS Credentials

Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded...