Malicious code in weavedb-exm-sdk-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3992f423f88c69e8c00223cc0ef81f970b8e178f1854beb00ef443586302ad89 package.json declares "preinstall": "./bin/install-deps", which runs a 976KB UPX-packed Linux x86 ELF binary on every npm install. The package...

MAL-2026-4721 Malicious code in weavedb-node-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...

Malicious code in weavedb-node-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...

PT-2026-43434

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A server-side request forgery SSRF issue exists where an unauthenticated attacker can send crafted requests to internal services due to insufficient input validation in an upload...

PT-2026-43300

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python checks.yml embeds $ github.event.pull request.title directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run tests model gen...

PT-2026-43433

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21.1 Description A Server-Side Request Forgery SSRF allows an attacker to force the server to send HTTP requests to internal services through the security advisories package lookup feature. By...

CGA-77J7-WW64-2WFV

Bulletin has no description...

Malicious code in tempo-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad4276e2eafbe6d7040f94ac546ec20e7ac211e1e5906964c25f581a519d183 [email protected] is a dependency-confusion attack package. The package.json preinstall hook executes poc.js, which on every npm install harvests...

⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times...

MAL-2026-4523 Malicious code in claude-channel-imessage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9751c370c062cb40bccb874f46679ad3ca8ba9d3b49d0d8ba1f924d9582e53a3 On npm install, postinstall.js executes whoami and id, reads os.hostname, os.platform, process.cwd, and the CI, GITHUBREPOSITORY, and NODEENV...

CVE-2026-47228

creationtimestamp| type| source ---|---|--- 2026-05-25 08:46:30+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w...

CVE-2026-47231

creationtimestamp| type| source ---|---|--- 2026-05-25 08:46:04+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9 2026-08-12 15:34:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2tsmvj5hdjmwn...

CVE-2026-47230

creationtimestamp| type| source ---|---|--- 2026-05-25 08:45:49+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36 2026-08-12 15:40:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6e3gk3aqb777g...

CVE-2026-47232

creationtimestamp| type| source ---|---|--- 2026-05-25 08:45:09+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg 2026-08-12 15:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5fxxz3gzce2tb...

CVE-2026-47234

creationtimestamp| type| source ---|---|--- 2026-05-25 08:44:49+00:00| published-proof-of-concept| https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88...

Exploit for Command Injection in Github Enterprise_Server

CVE-2026-3854 - GitHub Enterprise Server that allowed an Remot...

CVE-2026-36239

creationtimestamp| type| source ---|---|--- 2026-05-25 02:00:04+00:00| seen| https://t.me/GithubRedTeam/85759 2026-05-25 03:00:10+00:00| seen| Telegram/PWXxTbzLBS2I2NTEEZXYxWglH9J71PY-BvJO95sfjgRqY3E 2026-05-25 09:00:04+00:00| seen| Telegram/hq1WnakkbxJpSdatpwq9NAKRiUtHFa8ysgfQqaCqIO8mwqo...

Malicious code in @zizie071/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6d5096096e7e958916c5449a7480949135e6af5cd9acd4e1b1edab8c331163 On require, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter....

MAL-2026-4644 Malicious code in power-platform-playwright-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57967d58233d74f2fc4f9b0dee7c050370eb388050df8d63f29e719f83468d73 On npm install, the package's postinstall script postinstall.js collects host identifiers and CI context — whoami, os.hostname, os.platform, cwd, CI,...

CVE-2026-45618

creationtimestamp| type| source ---|---|--- 2026-05-24 13:22:43+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-gf2q-c269-pqgc 2026-08-11 20:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstiir6g362q...