@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +536 more potentially affected by CVE-2026-67320 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67320 Source advisory: OSV:GHSA-GCFJ-64VW-6MP9...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +17054 more potentially affected by CVE-2026-67319 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-67319 Source advisory: OSV:GHSA-7Q8Q-RJ6J-MHJQ...

123pancli (1.0.0), @0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1) +4616 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =1.0.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-67315 Source advisory: OSV:GHSA-F4GW-2P7V-4548...

123pancli (1.0.0), @0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1) +4616 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =1.0.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-67315 Source advisory: SNYK:JS-AXIOS-18065357...

abracadabra (>=0.0.0, <=0.0.7), acclimatise (>=0.0.18, <=1.2.0) +420 more potentially affected by CVE-2026-59925 via mistune (0.8.4)

mistune PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - abracadabra =0.0.0, =0.0.18, =2.0.0.post1, =0.3.0, =1.0.0, =1.3.4, =1.0.47, =1.0.66, =0.1.0, =0.1.0, =0.1.16, =0.18.3, =1.0.0, =2.2.0 and more...

@adobe/aem-cli (>=16.21.1, <=16.21.2), @adobe/helix-docx2md (>=1.9.29, <=1.9.30) +49 more potentially affected by CVE-2026-59870 via js-yaml (>=5.0.0, <=5.2.0)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.0.8, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260824173136 and more Source cves: CVE-2026-59870 Source advisory: OSV:GHSA-724G-MXRG-4QVM...

NPM: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

NPM: js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.0...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 3lc (>=2.12.0, <=2.22.0) +2453 more potentially affected by CVE-2026-55380 via pillow (10.4.0)

pillow PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 11x-wagtail-blog =0.0.0, =2.12.0, =0.1.0, =0.1.3, =0.3.0, =0.1.3, =0.1.0, =0.1.4, =0.3.0, =0.2.1, =0.2.0, =0.0.1, =0.0.0, =0.0.9 and more Source...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-54059 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

Hugging Face Says Autonomous AI Agent System Breached Production Infrastructure

An AI-led cyberattack breached limited Hugging Face datasets and service credentials, while public models, Spaces and published packages showed no signs of tampering...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...

MGASA-2026-0281 Updated python-nltk packages fix security vulnerability

URL-Encoded Path Traversal in nltk.data.load Allows Arbitrary Local File Read. CVE-2026-54293...

MGASA-2026-0274 Updated php packages fix a security vulnerability

The updated php packages fix a security issue: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD. CVE-2026-14355...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1562 more potentially affected by CVE-2026-67313 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...

Malicious Package

Overview OCI.DotNetSDK.Datalabeling.service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview Solana is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-8.2.hum1 aarch64, x8664 busybox-petitboot-1.37.0-8.2.hum1 aarch64, x8664 busybox-shared-1.37.0-8.2.hum1 aarch64, x8664 busybox-1.37.0-8.2.hum1.src src Security Fixes:...