CVE-2026-86358: Stack-based Buffer Overflow

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-7514: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

PT-2026-93842

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 26.07.03 Description An Unchecked Return Value issue exists where the software fails to properly verify the result of a function call. A low privileged attacker with local access can exploit this...

Malicious Package

Overview kartykp-prod-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview kartykp-token-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in cryptography Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

A missing permission check within the Setup Wizard allows for a potential remote package install . This vulnerability can lead to a remote escalation of privilege without requiring additional execution privileges or user interaction. Exploitation details are not provided in the documents.

EUVD-2026-78992

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Malicious Package

Overview afhmxiewpsf is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview strapi-plugin-yayccresh-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview postgreesqlhelper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview app-rrhh is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @merazmz/project-tracker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview ultra-ws is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview fulfillment-cuprum-auth-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...