604916 matches found
MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...
MAL-2026-10711 Malicious code in @funny-booth/agent-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...
Malicious code in discordia-telemetria (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7b7d95c58f4a5203f542a11bc6e8ea0ff4d55bf22b2db938b563f169a732265 setup.py contains a base64-encoded shell command that decodes to a curl fetch of an opaque binary from https://gaming-telemetry.com/v1/download, chmo...
CVE-2026-14890
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...
CVE-2026-47751
CVE-2026-47751 affects Claude Code Action prior to version 1.0.74. Due to the action checking out attacker-controlled PR head branches, reading .mcp.json from the working directory, and unconditionally enabling all MCP servers via enableAllProjectMcpServers, an attacker could trigger arbitrary co...
CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionall...
CVE-2026-43731
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...
CVE-2026-43740
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, leading to disclosure of process memory...
CVE-2026-43742
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...
CVE-2026-43727
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...
CVE-2026-43721
A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...
CVE-2026-43726
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...
ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earni...
CVE-2026-43707
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger memory corruption due to improper memory handling, resulting in an unexpected process crash...
CVE-2026-43699
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...
CVE-2026-43663
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, resulting in an unexpected process crash...
CVE-2026-39872
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, resulting in an unexpected process crash...
CVE-2026-43715
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...
CVE-2026-43725
A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper input validation, potentially allowing access to resources that should be restricted...