Malicious code in secure-test-browser-o87p0cmc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ebbd6f7909d5c2555e7e0283ba3e38ece5dc460c81d484d453b36b16e8d4471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-12x7arc7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a95958b9caa798f65faf31d5237e692374d377fb7968c74249e77f4545f170df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15367 Malicious code in secure-test-browser-j60bbhhk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49bdd6592be2c6e40af745c10ba4d43dd628015444f0e99fbdffb262b9660b07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ggbh6tng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd4edd79ce6ac910c2bd864624e532a72b39bf24106a2ea33dca8657f0e1ec6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15430 Malicious code in secure-test-browser-t7a9jtay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2e171ed7ab636742175ee4a3eb1043bcea89d15d080a05130a138bde7c265fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in secure-test-browser-y4yd7ndu

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in secure-test-browser-cxtwmz33 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7092be33c83477d7cc43dd45b61e91ad38a6e973506e3ce6dddaa74f00d0e81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15448 Malicious code in secure-test-browser-wrbb4ntb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a8dd86574941ec82e5b672934f23fcf3a5264516d64df5033b6ef2e688e190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15340 Malicious code in secure-test-browser-f0dzh835 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8117f018fbe2ce8c046c1d11130385bf498ff67562c6165cf1f678367f9783e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-82249 gitoxide before 0.38.2 Credential Helper Protocol Field Injection

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

curl: CVE-2026-87865: knownhost callback mismatches key as missing

When libcurl uses libssh2 with a hashed OpenSSH knownhosts file, an unrelated first entry can make a hostile key for an already pinned SFTP/SCP host reach CURLOPTSSHKEYFUNCTION as CURLKHMATCHMISSING instead of CURLKHMATCHMISMATCH. At...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Malicious code in flyteplugins-agento11y (PyPI)

Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

PT-2026-83293

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270: Server-Side Request Forgery (SSRF)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: virglrenderer (UTSA-2024-005588)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005588 advisory. A heap-based buffer overflow in the vrendrenderertransferwriteiov function in vrendrenderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial ...

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can reach the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mc (UTSA-2026-093026)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093026 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. A...