MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the mode parameter of the openDevTools function. An attacker ca...

CVE-2026-44605 Rpm: heap buffer overflow in ndb slot table parsing

A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memor...

CVE-2026-44605

A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memor...

CVE-2026-44605

A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memor...

CVE-2026-44605

CVE-2026-44605 describes a heap-based buffer overflow in RPM's NDB backend (lib/backend/ndb/rpmpkg.c) triggered while parsing the NDB slot table. The vulnerability arises from 32-bit arithmetic used to size a heap allocation (slotnpages * (PAGE_SIZE / SLOT_SIZE)); an attacker-controlled on-disk N...

Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

MAL-2026-13356 Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in python-dotenv - Patched by Root

Root has patched CVE-2026-28684 in the python-dotenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-67221 CVE-2025-67221 in orjson - Patched by Root

Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-3772 CVE-2024-3772 in pydantic - Patched by Root

Root has patched CVE-2024-3772 in the pydantic package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2016-10539 CVE-2016-10539 in negotiator - Patched by Root

Root has patched CVE-2016-10539 in the negotiator package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-NSWG-ECO-106 NSWG-ECO-106 in negotiator - Patched by Root

Root has patched NSWG-ECO-106 in the negotiator package for Root:npm. Multiple fixed versions available...

Improper Neutralization of Null Byte or NUL Character

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character via the shell.openPath function. An attacker can bypa...

ROOT-APP-PYPI-CVE-2023-46136 CVE-2023-46136 in Werkzeug - Patched by Root

Root has patched CVE-2023-46136 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-49767 CVE-2024-49767 in Werkzeug - Patched by Root

Root has patched CVE-2024-49767 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...