MAL-2026-10121 Malicious code in dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 196ec26fa9b08dfb6191a2f1c1e7258d4469932156002dcf27f142b682f301a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10125 Malicious code in dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a5a7f24cc73eb6660c6f8aa878b15409e5036a661210678896c25fcfe1f7c3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10123 Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab15ed01b9b4270e5605dcbb6ab8185f8b3501615c5f122a82d41deb14a7bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10122 Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c14d033e65a8eb68c616f92a5c9725e15522cfba83ec1a420d6438b2388871e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10126 Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e394751a822cba7556f9b6676b531a472c7c113da4458970b242b42df9d88e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10120 Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f891edea1f4959d4a81c055084d6e3fa6f4ab3dfb97435a2c393b741b9e15177 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10118 Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-59938

A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file with image size values that are significantly larger than the actual embedded image data, causing pypdf to allocate large amounts of memory when...

Malicious code in nodemon-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5488028be686500c0af6b7f91ead55be9ddaeb86f3b920fce7eed6f8111b0050 Package name, README, homepage nodemon.io, author remy, and source tree are copied verbatim from the widely-used 'nodemon' package, with the addition...

Improper Input Validation

github.com/coder/coder is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of the scheme and host in external workspace application URLs before substituting the $SESSIONTOKEN placeholder, which allows an attacker controlling a malicious workspace templa...

SUSE CVE-2026-11586

By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages...

SUSE CVE-2026-15110

Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

Malicious code in workspace-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 337be691dd0efaac223695a5cb4f51ab5cdcc6b3ccde983b86d7256b10d731a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10112 Malicious code in workspace-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 337be691dd0efaac223695a5cb4f51ab5cdcc6b3ccde983b86d7256b10d731a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10113 Malicious code in workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a299d08a926a020ab738de2ff3aee9ccbbdea3f90fc93c0a7a0d2ab8e8b22724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a299d08a926a020ab738de2ff3aee9ccbbdea3f90fc93c0a7a0d2ab8e8b22724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodemon-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5 The package is named nodemon-patch but its package.json metadata homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, fundin...

Malicious code in nodepack-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b976e6ab638a52663d25f360bffec6706dc82991ad27c552788a5a4d785ff89f The package presents itself as the popular pino logger README badges, file layout mirroring pino's lib/proto.js, lib/redaction.js, lib/transport.js,...

Linux Distros Unpatched Vulnerability : CVE-2026-56373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can...