CVE-2026-53597

CVE-2026-53597 affects the Prompty markdown format loader: for versions 2.0.0-alpha.1 through 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts did not override executable engines for js/frontmatter, allowing attacker-controlled .prompty file...

CVE-2026-53597

Prompty is a markdown file format .prompty for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an...

CVE-2026-53597 Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty is a markdown file format .prompty for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an...

CVE-2026-53597 Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty is a markdown file format .prompty for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an...

CVE-2026-59867 Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote https URLs and reading local absolute or out-of-tree file paths, allowing kiota generate on an attacker-controlled or attacker-influenced description to perform...

CVE-2026-59867

CVE-2026-59867 affects Kiota, an OpenAPI-based HTTP client code generator. Before 1.32.5, Kiota’s OpenAPI $ref resolution could fetch remote http(s) URLs or read local absolute/out-of-tree file paths, enabling build‑time SSRF, remote file inclusion, and local file inclusion when generating client...

HelloNet campaign: new malicious modules launched through the ViPNet update system

UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting. UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response. UPD 16.07.2026: Added...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

PT-2026-60484

Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2 Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1919)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1919 advisory. A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 and likely earlier versions within the handling of uncompressed HEIF images ISO/IEC 23001-17, unci item type. When...

Malicious code in selparsecss-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f [email protected] is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' while the LICENSE-MIT, sour...

Malicious code in react-hook-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52d4b717c5de5139b732e16ea9eca2654947ecf17e919334a6dd039c5b60e059 The package's default export getPlugin fetches a JSON document from the hardcoded endpoint https://svganchordev.net/icons/108 and passes the returned...

CVE-2026-43637

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extractarchive function in...

RLSA-2026:39297 Moderate: edk2 security, bug fix, and enhancement update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 openssl: OpenSS...

edk2 security, bug fix, and enhancement update

An update is available for edk2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/[email protected]...

MAL-2026-10626 Malicious code in @react-case/option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...

RockyLinux 10 : edk2 (RLSA-2026:39297)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39297 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 openssl: OpenSSL: Denial of Service due to...

RHEL 10 : edk2 (RHSA-2026:39297)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39297 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware...