MAL-2026-10210 Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...

Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...

Malicious code in nullrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29ebce322ac712405bfd29254cbd8f820c20ddc083587693a982b75ef6f3039a Package advertises itself as an SVG fetcher/sanitizer but its main module also exports an undocumented getPlugin function. The returned function...

MAL-2026-10206 Malicious code in nullrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29ebce322ac712405bfd29254cbd8f820c20ddc083587693a982b75ef6f3039a Package advertises itself as an SVG fetcher/sanitizer but its main module also exports an undocumented getPlugin function. The returned function...

MAL-2026-10199 Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproduce...

Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...

MAL-2026-10194 Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...

wordpress-ocr-internal-pentest

─── Internal Web Application & OCR Service ─── 🛡️ A...

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. "At Balochistan Police, the compromised assets includ...

CVE-2026-50163 vulnerabilities

Vulnerabilities for packages: ratify-fips, argocd-image-updater, zot, oras, zarf, crossplane-fips, consul-k8s, opa-fips, cilium-cli, gatekeeper, steampipe, tigera-operator-fips, opa-envoy, k8ssandra-client, rancher-agent, cloudbeat-fips, drone-fips, flux-helm-controller-fips, tigera-operator,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: ratify-fips, argocd-image-updater, zot, oras, zarf, crossplane-fips, consul-k8s, opa-fips, cilium-cli, gatekeeper, steampipe, tigera-operator-fips, opa-envoy, k8ssandra-client, rancher-agent, cloudbeat-fips, drone-fips, flux-helm-controller-fips, tigera-operator,...

CVE-2026-50163 vulnerabilities

Vulnerabilities for packages: linkerd2, rancher, tigera-operator, opa-envoy, kots, zarf, cilium-cli, argo-cd, opa, oras, helm-operator, gatekeeper, rancher-fleet, argocd-image-updater, ratify, zot, gogatekeeper, chartmuseum, trivy-operator, headlamp, trivy, rancher-agent, grafana-operator,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: linkerd2, rancher, tigera-operator, opa-envoy, kots, zarf, cilium-cli, argo-cd, opa, oras, helm-operator, gatekeeper, rancher-fleet, argocd-image-updater, ratify, zot, gogatekeeper, chartmuseum, trivy-operator, headlamp, trivy, rancher-agent, grafana-operator,...

Exploit for CVE-2024-13985

CVE-2024-13985 — Dahua EIMS capturehandle.action Remote Cod...

Exploit for CVE-2026-29114

CVE-2026-29114 — Dahua Exposed Device CA Root Certificate !...

Exploit for CVE-2026-29115

CVE-2026-29115 — Dahua Authenticated Remote Denial of Service...

Exploit for CVE-2026-29116

CVE-2026-29116 — Dahua Unauthenticated Remote Denial of Servic...

Injection axios Dependency in Confluence Data Center

This High severity Injection vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Injection vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N allows an...