08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +11363 more potentially affected by CVE-2026-83610 via xmldom (>=0.1.2, <=0.5.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.23, =1.0.0, =0.0.3, =0.0.9 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...

Malicious code in @onereach/idw-apps (npm)

npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @or-sdk/tickets (npm)

npm/@or-sdk/tickets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: cert-manager, vendir, kubernetes-dashboard, oras, docker-cli-buildx, filebrowser, rancher-helm, terraform, fscrypt, helm-set-status, argo-cd, podman, eksctl, policy-controller, malcontent, chezmoi, k8ssandra-client, kubescape, grafana-operator, external-dns, helm-pus...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: flux-source-watcher, crossplane-provider-aws-servicediscovery, syft, dynamic-localpv-provisioner, crossplane-provider-aws-ecr-fips, crossplane-aws-provider, envoy-ratelimit-fips, secretgen-controller, knative-eventing, flannel-fips, secrets-store-csi-driver-fips,...

Malicious code in py-infopiplgtb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7a554864c67e1208f5c45369e15f8169d30257402cd480e517547f7b4fdf7b90 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libgrandint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5a8ce90bf68ce36f12624df7262d8e4d5da9824b6e9f28a4a87f7ffdb6f5df2d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqstringnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8bc83f0d955a843c0eb6b2c34fe22424c9fd7dcdebd0075eb89f5966cd027bdb EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in craftgame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 870d9cb8a8d09370325646ee1eb8f16f86b00e17785d1c5d10cbd9b3cd865b63 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tkcaalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 954677803cf5ebe654bfd7eedd0a3164de3ac7c292e6f8d0c262c076f8b02728 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ycodestyle (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fffb5ae3e1f41a6b55f5c5ce485edd1290ef043de7ee30f907a21dc4ccb016b0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in prompt-tookit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5d92327d14ed9c546cc8da4686d6444e8618ca3ee12fa7dcc1e887f63378235e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in xlsxwrtier (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 38e1ab75b1064d2fa63893a585adf60c88b1e88a47afeaed606553dd7d98dcb5 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in sloana (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 25898ab1b9774b92af1f740bfd1366de9381ea6feb7f1c184d7abf8c375d5ac8 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...