MAL-2026-7000 Malicious code in pipo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 259159c0505b819905dcaf53172d98a4fd590a9ae1a40f87d2be4c1a7fdc4065 This package is a dependency-confusion payload published at an abnormally high version 9999.0.0 targeting an internal package name pipo-sdk. The...

CVE-2026-14739

creationtimestamp| type| source ---|---|--- 2026-07-08 00:34:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3uqppnkw2i 2026-07-08 14:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5ccbcr3u2b 2026-07-09 09:42:04+00:00| seen|...

PYSEC-2026-2011 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

Summary A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows...

CVE-2025-50492

creationtimestamp| type| source ---|---|--- 2026-07-06 06:08:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxggl6bz52i...

CVE-2025-71343

creationtimestamp| type| source ---|---|--- 2026-07-04 04:16:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mps7arpltr27 2026-07-04 06:14:47+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpsfunjwiy2x 2026-07-04 15:01:15+00:00| seen|...

CVE-2026-57765

creationtimestamp| type| source ---|---|--- 2026-07-02 12:14:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpnyzwok7p2w 2026-07-02 13:42:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpo5xsoa2s2m 2026-07-03 00:46:54+00:00| seen|...

CVE-2026-55597

creationtimestamp| type| source ---|---|--- 2026-07-02 11:56:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnxzt4tn52o 2026-07-03 13:27:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnlk6zdd2y...

CVE-2026-14417

creationtimestamp| type| source ---|---|--- 2026-07-02 00:09:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmqj2s5wc2e 2026-07-02 02:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpmwrtq35n2x 2026-07-02 03:00:27+00:00| seen|...

Malicious code in @marketfront/blenderdevtool (npm)

The @marketfront/blenderdevtool package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

Malicious code in @marketfront/errorcounter (npm)

The @marketfront/errorcounter package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6774 Malicious code in @marketfront/devtoolsloader (npm)

The @marketfront/devtoolsloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

CVE-2026-13999

creationtimestamp| type| source ---|---|--- 2026-07-01 21:17:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgwfxuab26 2026-07-02 07:48:50+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:21:14+00:00| seen|...

MAL-2026-6713 Malicious code in polymarket-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa9243f492d222e1bb036c8ed55fb17268bd987a63ad2ea2aa1b28e44defc3 Package is published as a Polymarket API client but its default export getPlugin performs unconditional remote code execution on use. On invocation i...

CVE-2026-13798

creationtimestamp| type| source ---|---|--- 2026-07-01 05:09:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116842990988360734 2026-07-02 07:18:59+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:10+00:00| seen|...

CVE-2026-10763

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:2676-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2676-1 advisory. This update for bind fixes the following issues - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation...

CVE-2026-56968

creationtimestamp| type| source ---|---|--- 2026-06-29 23:52:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphonpawcs27...

CVE-2026-42012

creationtimestamp| type| source ---|---|--- 2026-06-29 11:40:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfqrgxrk2t...

Security update for bind

This update for bind fixes the following issues CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records bsc1265592. CVE-2026-5946: Invalid handling of CLASS != IN bsc1265594. CVE-2026-595...