CVE-2026-44972

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...

CVE-2026-3489

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

GHSA-HPM9-74QX-6X32 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-CMPJ-5W72-JQ28 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-982W-2WQP-Q964 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-48XX-R45R-42QG vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

CVE-2008-3109 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-3FX3-QCJV-QR6H vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

CVE-2008-3115 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-FJ22-5G9H-44W5 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-G23F-VWRR-7M5P vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

GHSA-F5XR-W782-5RG9 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

CVE-2008-3112 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-21-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-11-openj9, openjdk-25-openj9...

CVE-2026-9899 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-2PM8-794W-P8M4 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-42266

A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from...

CVE-2026-42251

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-8421

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the installpackage method of concrete/controllers/singlepage/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under...

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer...