MAL-2026-5193 Malicious code in javascript-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d83c3b506a10b770a8c1f98d280262478cccc65708bb1066a72e0708dccaaf75 This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinsta...

CVE-2026-41249

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow .github/workflows/static.yml uses the pullrequesttarget trigger but dangerously checks out the unverified code from the pull request head ref: $ github.event.pullrequest.head.re...

GHSA-HC4F-JC7G-W997 vulnerabilities

Vulnerabilities for packages: openjpeg...

EUVD-2026-34318

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow .github/workflows/static.yml uses the pullrequesttarget trigger but dangerously checks out the unverified code from the pull request head ref: $ github.event.pullrequest.head.re...

CVE-2026-41249 CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow .github/workflows/static.yml uses the pullrequesttarget trigger but dangerously checks out the unverified code from the pull request head ref: $ github.event.pullrequest.head.re...

GHSA-M62J-63MF-XR95 vulnerabilities

Vulnerabilities for packages: dnsmasq...

CVE-2026-54458

creationtimestamp| type| source ---|---|--- 2026-06-04 14:49:58+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35 2026-07-15 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpq2bpz642l 2026-07-15 23:01:02+00:00|...

poc-exploit-github-actions-pull-request-write-vuln-demo

No d...

PT-2026-46945

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Description An issue exists in the Envoy gateway related to HTTP/2, which can be exploited to cause a denial of service, potentially bringing down an Evonode. There have been reports of elevated activities...

CVE-2026-49144

creationtimestamp| type| source ---|---|--- 2026-06-03 21:38:40+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-8rpw-6cqh-2v9h 2026-06-03 23:10:53+00:00| seen| https://gist.github.com/alon710/f7bc5351b219485c56b8d23a92985578 2026-06-03 23:20:57+00:00| seen|...

Microsoft Fixes One-Click GitHub Dev Attack That Let Attackers Steal OAuth Tokens

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code VS Code that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones...

CVE-2026-35904

creationtimestamp| type| source ---|---|--- 2026-06-03 17:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87170 2026-06-03 19:00:30+00:00| seen| Telegram/Ze-uNkS3kIdAJGbWQE6AK--K-SMWz6YbrFE-sDGCdUicf4Q 2026-06-03 21:00:04+00:00| seen|...

1click-gh-token-stealing-via-vscode-POC

1-Click GitHub Token Stealing via VSCode Proof-of-Concept exp...

ROOT-APP-PYPI-GHSA-C2JP-C369-7PVX GHSA-c2jp-c369-7pvx in rootio-fastmcp - Patched by Root

Root has patched GHSA-c2jp-c369-7pvx in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-54094

creationtimestamp| type| source ---|---|--- 2026-06-03 11:43:02+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v...

CVE-2026-54090

creationtimestamp| type| source ---|---|--- 2026-06-03 08:07:50+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8c9q-7855-wfxq...

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 maliciously modified packages across more than 90 versions under the @redhat-cloud-services npm scope. The...

Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)

The remote host has a version of one or more Node.js modules installed known to be compromised in the Shai-Hulud 'Miasma' npm supply chain attack reported on 06/01/2026. This wave compromised 32 packages 96 versions published under the '@redhat-cloud-services' npm scope. It is tracked separately...

EUVD-2026-34098

A DLL hijacking vulnerability in Wassimulator GitHub CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL...

Linux Distros Unpatched Vulnerability : CVE-2026-48501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository...