MAL-2026-15441 Malicious code in secure-test-browser-uwydfkra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27aa86f8da7b4874fce31dd729ea9f452e0f892cd470124c903c73ccf0e3de07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15367 Malicious code in secure-test-browser-j60bbhhk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49bdd6592be2c6e40af745c10ba4d43dd628015444f0e99fbdffb262b9660b07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15423 Malicious code in secure-test-browser-rwlrhorb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0062667aa6dd36579ced99b50ace1b631360a5a98e8e94475e492e8f0e6e40e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-puq5o3yn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8db273e70dc21dab786dd87a8bf168c2ddbd80be8e75f4ef3c741d39b52c2d99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-o87p0cmc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ebbd6f7909d5c2555e7e0283ba3e38ece5dc460c81d484d453b36b16e8d4471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15448 Malicious code in secure-test-browser-wrbb4ntb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a8dd86574941ec82e5b672934f23fcf3a5264516d64df5033b6ef2e688e190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15340 Malicious code in secure-test-browser-f0dzh835 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8117f018fbe2ce8c046c1d11130385bf498ff67562c6165cf1f678367f9783e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-cxtwmz33 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7092be33c83477d7cc43dd45b61e91ad38a6e973506e3ce6dddaa74f00d0e81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in secure-test-browser-y4yd7ndu

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in secure-test-browser-ggbh6tng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd4edd79ce6ac910c2bd864624e532a72b39bf24106a2ea33dca8657f0e1ec6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15430 Malicious code in secure-test-browser-t7a9jtay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2e171ed7ab636742175ee4a3eb1043bcea89d15d080a05130a138bde7c265fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-82249 gitoxide before 0.38.2 Credential Helper Protocol Field Injection

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

curl: CVE-2026-87865: knownhost callback mismatches key as missing

When libcurl uses libssh2 with a hashed OpenSSH knownhosts file, an unrelated first entry can make a hostile key for an already pinned SFTP/SCP host reach CURLOPTSSHKEYFUNCTION as CURLKHMATCHMISSING instead of CURLKHMATCHMISMATCH. At...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Malicious code in flyteplugins-agento11y (PyPI)

Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

CVE-2026-82270: Server-Side Request Forgery (SSRF)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

PT-2026-83293

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can reach the...