Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

MAL-2026-10698 Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

MAL-2026-10697 Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10694 Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

ROOT-OS-DEBIAN-12-CVE-2023-31484 CVE-2023-31484 in rootio-perl - Patched by Root

Root has patched CVE-2023-31484 in the rootio-perl package for Root:Debian:12. Multiple fixed versions available...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-15943 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-15943 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751615...

ROOT-APP-NPM-CVE-2024-21507 CVE-2024-21507 in @rootio/mysql2 - Patched by Root

Root has patched CVE-2024-21507 in the @rootio/mysql2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-6485 CVE-2024-6485 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2024-6485 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2024-10105 AIKIDO-2024-10105 in @rootio/pug - Patched by Root

Root has patched AIKIDO-2024-10105 in the @rootio/pug package for Root:npm. Multiple fixed versions available...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: coreutils: coreutils-9.11-5.hum1 aarch64, x8664 coreutils-common-9.11-5.hum1 aarch64, x8664 coreutils-single-9.11-5.hum1 aarch64, x8664 coreutils-9.11-5.hum1.src src...

MAL-2026-10692 Malicious code in nyt-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bf0f1d5cc9a57edf1b570b517d09c6acf7c98223858d08a5f162c250f6965f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

Alibaba Cloud Linux 3 : 0193: grafana-pcp (ALINUX3-SA-2026:0193)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0193 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-39821: The ToASCII and ToUnicode functions...

Malicious code in syft-acp-core (npm)

The syft-acp-core package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

Malicious code in @across-toolkit/typescript-config (npm)

The npm package @across-toolkit/typescript-config is a dependency-confusion credential stealer targeting developers of Across Protocol across.to. It masquerades as an internal ESLint/TypeScript config for the across.to toolkit and publishes an implausibly high version 99.0.0 so that a misconfigur...

The vulnerability of the automatic software update mechanism of the ViPNet Client 4 system, related to deficiencies in handling relative paths, allows a malicious intruder from a neighboring trusted network to compromise the integrity of the operating environment. This vulnerability enables the intruder to gain privileges in the attacked node’s system and execute arbitrary code using a specially crafted update package sent from a compromised network node with the role of a network management center.

The vulnerability of the automatic software update mechanism of the ViPNet Client 4 lies in the deficiencies in the handling of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating...