GHSA-WH8J-WM5W-MX75 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-276G-W4M7-HP25 vulnerabilities

Vulnerabilities for packages: chromium...

CGA-5QFX-MCM5-7P6G

Bulletin has no description...

CVE-2026-54592

creationtimestamp| type| source ---|---|--- 2026-06-16 10:49:19+00:00| published-proof-of-concept| https://github.com/ohler55/oj/security/advisories/GHSA-3m6q-jj5j-38c9 2026-07-01 02:23:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpkhjtnps32z 2026-07-02 01:12:26+00:00| seen|...

CVE-2025-61224

creationtimestamp| type| source ---|---|--- 2026-06-16 04:05:56+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-61224.yaml...

North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels

Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview aka Famous Chollima, HexagonalRodent, and Void Dokkaebi. According to a report published by Proofpoint, the threat actor has...

Incomplete Cleanup

Overview Affected versions of this package are vulnerable to Incomplete Cleanup in the diskStorage function. An attacker can exhaust disk space by repeatedly initiating and aborting multipart uploads, causing orphaned partial files to accumulate on disk. Remediation A fix was pushed into the mast...

MAL-2026-5789 Malicious code in claude-cup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c369ccf7b5e0ef8721b5ecdc94bd843ce260923394f6c513350a58928abdbdd3 On first invocation of npx claude-cup and on every subsequent Claude Code tool call once hooks are installed, research/config-audit.js enumerates eve...

Leak in WASIp1 `fd_renumber` implementation

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf For more information see the GitHub-hosted security advisory...

[SECURITY] Fedora 44 Update: gh-2.94.0-1.fc44

A command-line interface to GitHub for use in your terminal or your scripts. gh is a tool designed to enhance your workflow when working with GitHub. It provides a seamless way to interact with GitHub repositories and perform vari ous actions right from the command line, eliminating the need to...

MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens

Compared with binaries and decompiled code, malware source code more directly reflects the attackers' original intent. However, the scarcity of source code and the high cost of manual review make such datasets difficult to build and maintain. We propose MASCOT-Android, a curated dataset of Androi...

CVE-2026-46607

creationtimestamp| type| source ---|---|--- 2026-06-13 13:43:13+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j...

CVE-2026-46608

creationtimestamp| type| source ---|---|--- 2026-06-13 13:42:55+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr...

GHSA-6JV9-X5W9-2CCM vulnerabilities

Vulnerabilities for packages: tez, thingsboard, celeborn, management-api-for-apache-cassandra-5.0...

MAL-2026-5723 Malicious code in @ci-lifecycle-test/postinstall-ping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c160ad40a237c1e682c696ebd0aec2861ca072f47bd5b725bc80f7f95ed509 The package's postinstall lifecycle script postinstall.js executes automatically on npm install and POSTs the JSON-serialized contents of the entire...

Fedora 44 : composer (2026-9b34a78e81)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9b34a78e81 advisory. Version 2.10.1 - 2026-06-04 Security: Fixed shell escaping when opening an editor 12903 Security: Verify backup phar signature before restoring it when using...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack inadequate validation of symlink targets in the file access process. An attacker can access or modify files outside of the intended user scope by creating or leveraging symbolic links that point to locations beyond the...

CVE-2026-46672

creationtimestamp| type| source ---|---|--- 2026-06-12 20:16:24+00:00| published-proof-of-concept| https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq...

Missing Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Missing Authorization via the buildSchema controller. An attacker can modify schema metadata and automation trigger output schema by sending unauthenticated requests to the affected endpoint,...

OPENSUSE-SU-2026:20963-1 Security update for neonmodem

This update for neonmodem fixes the following issues: Changes in neonmodem: - Update golang.org/x/net dependency to v0.55.0 due to bsc1267193 - Update golang.org/x/image dependency to v0.38.0 due to bsc1260727 - Update golang.org/x/term dependency to v0.42.0 due to bsc1260727 - Update to version...