MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

MAL-2026-13714 Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

CVE-2026-72588 bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

EUVD-2026-55218

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

CVE-2026-72588

Summary : CVE-2026-72588 affects bluewave-labs/Checkmate up to version 2.1.0. The vulnerability resides in the password-recovery endpoint /api/v1/auth/recovery/request, where an unauthenticated attacker can determine if an email is registered by observing differing HTTP responses (HTTP 200 for re...

CVE-2026-18998

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18997

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-18998 cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

EUVD-2026-53712

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18998

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

EUVD-2026-53709

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

Exploit for CVE-2026-17583

cve-id Donate Support the maintenance of this project wit...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

How Status Labs Helps Brands Get Cited in ChatGPT: The Data Behind AI Search Visibility

Disclosure: This article was created in collaboration with Status Labs...

[SECURITY] Fedora 44 Update: unbound-1.25.2-1.fc44

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...