CVE-2026-14818

CVE-2026-14818 describes a path traversal vulnerability in the CLI command used to execute configuration files on Zyxel devices. Affected firmware ranges include Zyxel ATP series (V4.32–V5.42 Patch 1), USG FLEX series (V4.50–V5.42 Patch 1), USG FLEX 50(W) series (V4.16–V5.42 Patch 1), and USG20(W...

Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

MAL-2026-11515 Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

The widespread adoption of open source software OSS has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

CVE-2026-48063 Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to...

MAL-2026-11512 Malicious code in internallib_v524 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...

Malicious code in internallib_v524 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...

Malicious code in instalogin1234 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...

MAL-2026-11503 Malicious code in instalogin1234 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211

CVE-2026-47211 affects Ouroboros (local-first runtime for AI coding agents). Prior to version 0.39.0, loading the project-local .env could cause arbitrary code execution when a user runs Ouroboros commands in a cloned malicious repository; execution-affecting variables like OUROBOROS_CLI_PATH and...

EUVD-2026-52425

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-67312

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

CVE-2026-18718

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyz...

EUVD-2026-52372

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyz...