Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

MAL-2026-12465 Malicious code in streak-daykey-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bfd8e4427384eea912513d380b6615e3213b2df455b3dd42e2292467127b307 On module load, index.mjs invokes flushInternalData, which creates /.cache/openlarq, downloads a binary from a base64-obfuscated Backblaze B2 URL...

CVE-2026-64634

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p...

CVE-2026-64631

creationtimestamp| type| source ---|---|--- 2026-08-05 13:05:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p...

GHSA-M4HF-6VGR-75R2

creationtimestamp| type| source ---|---|--- 2026-08-05 12:34:16+00:00| seen| https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-71248

creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn3sdny23 2026-08-05 12:37:13+00:00| seen| https://bsky.app/profile/cybercod.bsky.social/post/3msdk5vqh5r2y...

GHSA-2GX6-7GX2-WWCF

creationtimestamp| type| source ---|---|--- 2026-08-05 11:31:33+00:00| seen| https://gist.github.com/alon710/98861561e950349ba52fdd407f74f7c8...

CVE-2026-70588

creationtimestamp| type| source ---|---|--- 2026-08-05 11:31:33+00:00| seen| https://gist.github.com/alon710/98861561e950349ba52fdd407f74f7c8...

CVE-2026-71231

creationtimestamp| type| source ---|---|--- 2026-08-05 11:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgfwm5ur2f...

CVE-2026-15452

creationtimestamp| type| source ---|---|--- 2026-08-05 10:30:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hpglrn2nlmpgf...

CVE-2026-7444

creationtimestamp| type| source ---|---|--- 2026-08-05 10:10:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/g2qu2owwxt7mn 2026-08-06 13:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msg4qorpbj2g...

GHSA-4WX2-7GVJ-QFQ3

creationtimestamp| type| source ---|---|--- 2026-08-05 09:31:26+00:00| seen| https://gist.github.com/alon710/8a67496a2aeb5dc5719baf5a0f706ea5...

CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-71207

creationtimestamp| type| source ---|---|--- 2026-08-05 09:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msd7b22cji2a...

CVE-2026-70376

creationtimestamp| type| source ---|---|--- 2026-08-05 09:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msd7aysupv2p 2026-08-12 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97719 2026-08-13 00:00:09+00:00| published-proof-of-concept|...

Malicious code in tinkoff-boxy-atom-text-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3606d69d2c4891a247201742fcab0e3069060e9d669e537de5758c5a03279521 The package's index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path and fetches bytes from one...

MAL-2026-12227 Malicious code in tinkoff-boxy-atom-text-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3606d69d2c4891a247201742fcab0e3069060e9d669e537de5758c5a03279521 The package's index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path and fetches bytes from one...

CVE-2026-18900

creationtimestamp| type| source ---|---|--- 2026-08-05 08:53:13+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msd5nfsevf2u...

CVE-2026-64574

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...