Malicious code in expect-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

Linux Distros Unpatched Vulnerability : CVE-2026-64757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS...

Linux Distros Unpatched Vulnerability : CVE-2026-28984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe...

Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

PT-2026-79133

Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in rc4-secure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt invokes...

MAL-2026-14305 Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

CVE-2026-32475

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

MAL-2026-14303 Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-76226 Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

GHSA-7788-GHFQ-C6MH

creationtimestamp| type| source ---|---|--- 2026-08-19 10:31:45+00:00| seen| https://gist.github.com/alon710/0cc60371850e568781debde747fcbd5a...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

Malicious code in emoji-prints-fancy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...