Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

CVE-2026-54051

creationtimestamp| type| source ---|---|--- 2026-06-02 20:40:48+00:00| published-proof-of-concept| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qw6v-5fcf-5666 2026-07-20 17:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3tqdty562a 2026-07-20...

GHSA-29H4-R29X-HCHV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-M976-87WM-48FM vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-Q94G-3GCF-66X7 vulnerabilities

Vulnerabilities for packages: uutils...

GHSA-897W-FCG9-F6XJ vulnerabilities

Vulnerabilities for packages: kserve, py3-cassandra-medusa...

CVE-2026-52878

creationtimestamp| type| source ---|---|--- 2026-06-02 10:34:12+00:00| published-proof-of-concept| https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr 2026-08-08 00:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msjrbwd7al2w...

CVE-2026-52880

creationtimestamp| type| source ---|---|--- 2026-06-02 10:32:57+00:00| published-proof-of-concept| https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9 2026-08-08 00:01:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msjrdieu5f2m...

CVE-2026-52879

creationtimestamp| type| source ---|---|--- 2026-06-02 10:32:40+00:00| published-proof-of-concept| https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg 2026-08-08 00:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msjrc5bbpc2b...

CVE-2026-47249

creationtimestamp| type| source ---|---|--- 2026-06-02 10:30:29+00:00| published-proof-of-concept| https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 2026-08-08 00:03:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msjrdw2woo2y...

GHSA-HPFW-MQM3-33JH vulnerabilities

Vulnerabilities for packages: uutils...

GO-2026-4960 Neko has a Self-service Privilege Escalation for Authenticated Users in github.com/m1k1o/neko/server

Neko has a Self-service Privilege Escalation for Authenticated Users in github.com/m1k1o/neko/server...

CVE-2026-8206

creationtimestamp| type| source ---|---|--- 2026-06-01 20:00:04+00:00| seen| https://t.me/GithubRedTeam/86883 2026-06-01 23:00:14+00:00| seen| Telegram/WmCsGmCxw3llm8l2PpPL4TbSd7NmUffJbXR2OZgq87qhTE 2026-06-02 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnbr4mqu6h2j...

GHSA-35JP-WW65-95WH vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kibana, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards, awx, langfuse, prism, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, nextcloud-server, unleash, kubeflow-centraldashboard, librechat, lerna, opensearch-dashboards-fips,...

Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm

A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma , has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and deliver a self-propagating worm. "This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of...