agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2025-62800 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

PYSEC-2026-1485 Kedro allows Remote Code Execution by Pulling Micro Packages

In kedro-org/kedro version 0.19.8, the pullpackage API function allows users to download and extract micro packages from the Internet. However, the function projectwheelmetadata within the code path can execute the setup.py file inside the tar file, leading to remote code execution RCE by running...

Malicious code in private-packages-sharingsession (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in private-packages-sharing-sessionz (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7351 Malicious code in private-packages-sharingsession (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7350 Malicious code in private-packages-sharing-sessionz (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @gpbw-fcop-ui-packages/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

AlmaLinux 8 : libreoffice (ALSA-2026:35839)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35839 advisory. libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation CVE-2026-8357 Tenable has extracted the preceding...

Medium: opensc

Issue Overview: A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The...

Linux Distros Unpatched Vulnerability : CVE-2026-54433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting XSS via a crafted plain-text email message. The...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2100 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =1.0.0, =0.0.1, =0.0.39 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

Malicious Package

Overview paysafe-cards is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview paysafe-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview paysafe-vault is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview paysafe-payments is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview paysafe-kyc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21693 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

Malicious Package

Overview renderctx is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tailwindcss-svg-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview graphpilot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...